admin/mthcht-ThreatHunting-Keywords
1
0
Fork 0
mirror of https://github.com/mthcht/ThreatHunting-Keywords synced 2026-06-08 16:12:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update false_positives_greyware_keywords.md

Browse Source
This commit is contained in:
mthcht
2025-02-17 10:45:31 +01:00
committed by GitHub
parent ebd965cfb2
commit 9c4b121188
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
_false_positives/false_positives_greyware_keywords.md
+8
View File
@@ -52,3 +52,11 @@ Kaspersky kavfswp.exe changed whoami.exe file creation time
- process: `C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security for Windows Server\kavfswp.exe`
- target file_path: `C:\Windows\SysWOW64\whoami.exe` OR `C:\Windows\System32\whoami.exe`
- user: `NT AUTHORITY\SYSTEM`
### Keyword: `reg*save*HKLM\*SYSTEM *`
`ir_agent.exe` is the core executable of the **Rapid7 Insight Agent** and it might be collecting registry information for vulnerability assessments, configuration analysis, or forensic investigations.
- parent_process_path: `C:\Program Files\Rapid7\Insight Agent\components\insight_agent\*\ir_agent.exe`
- process: `C:\Windows\System32\reg.exe save HKLM\SYSTEM "C:\Program Files\Rapid7\Insight Agent\components\insight_agent\common\ir_agent_tmp\agent.jobs.tem_realtime_*\tmp*\HKEY_LOCAL_MACHINE_SYSTEM.hiv`
- src_user: `*$`