增加BRC4的检测

2022-09-21 15:28:07 +08:00
parent ee5ae888ce
commit a1c158f8cd
7 changed files with 85 additions and 14 deletions
--- a/Server/plugins/mimikazt_detect/mimikatz_detect.py
+++ b/Server/plugins/mimikazt_detect/mimikatz_detect.py
@@ -14,11 +14,8 @@ mimikatz_dll_list = [
    'c:\\windows\\system32\\cryptdll.dll',
    'c:\\windows\\system32\\gdi32.dll',
    'c:\\windows\\system32\\imm32.dll',
-    'c:\\windows\\system32\\kernel32.dll',
-    'c:\\windows\\system32\\kernelbase.dll',
    'c:\\windows\\system32\\msasn1.dll',
    'c:\\windows\\system32\\msvcrt.dll',
-    'c:\\windows\\system32\\ntdll.dll',
    'c:\\windows\\system32\\rpcrt4.dll',
    'c:\\windows\\system32\\rsaenh.dll',
    'c:\\windows\\system32\\samlib.dll',