Windows Processes, Nefarious Anomalies, And You

Looking at how Windows does ✨ stuff ✨

In this two part series, I took a look at some common anomalies in Windows Processes which could be cause for concern. This is done by looking at memory regions, threads, and call stacks and extracting information which could mean that the process is behaving weirdly. This can either be used to detect implants, or QA implants...

Both blogs are external on the TrustedSec blog!

Windows Processes, Nefarious Anomalies, and You: ThreadsTrustedSec

Windows Processes, Nefarious Anomalies, and You: Memory RegionsTrustedSec