Elasticsearch-Based Threat Hunting to Detect Privilege Escalation Using Registry Modification and Process Injection Attacks

Malicious actors often exploit persistence mechanisms, such as unauthorized modifications to Windows startup directories or registry keys, to achieve privilege escalation and maintain access on compromised systems. While information technology (IT) teams legitimately use these AutoStart Extension Po...

Descripción completa

Detalles Bibliográficos

Autores principales:	Akashdeep Bhardwaj, Luxmi Sapra, Shawon Rahman
Formato:	Artigo
Lenguaje:	Inglês
Publicado:	MDPI AG 2025-08-01
Colección:	Future Internet
Materias:	privilege escalation persistence windows registry startup directory AutoStart Extension Point (ASEP) Sysmon
Acceso en línea:	https://www.mdpi.com/1999-5903/17/9/394
Etiquetas:	Agregar Etiqueta Sin Etiquetas, Sea el primero en etiquetar este registro!