Jamf Nation
IP Geo-Location Extension Attribute Closely Resembles Keylogger Behavior
WTFBins
Latest posts
pia-daemon ICMP Flood
pia-daemon emits 'ICMP Flood' behavior every minute. This is a 'latency check' which is used for server selection.
Block64 Uses Impacket
The Block64 Discovery Agent uses Impacket's psexec module, scaring SOC analysts everywhere when it's deployed.
DTS Sound Unbound Ransomware File Extension
Services created as part of this application installation and usage will create or rename files with a .crypt extension.
Podman Desktop
Podman Desktop writes .vbs to the Startup folder.
Microsoft Managed Desktop Agent
Microsoft loves to look like malware, huh?
Veritas Backup Agent (Symantec)
Another bin with an identity crisis.
Adobe CC Setup
Adobe performs...process injection??
ESET AV Module (ekrn.exe)
What is it with antivirus and weird DNS?
EndpointBasecamp.exe, RiskIndexCollector.exe
A little wmic enumeration
Teramind's dwm.exe
Nacho dwm
IBM's pcsnp.exe triggers SYSTEM cmd.exe
IBM's pcsnp.exe just...what
OpenVAS runs WMIExec
TFW the vuln scanner runs offensive tools.
SecurityHealthService.exe unprotects LSA
Who needs protection? Not LSA!
draw.io.exe
Nothing to see here
JetBrains binaries invoke WMI
JetBrains queries security tools.
IBM Storage Insights Data Collector
IBM creates WMI false positives
Cisco Jabber
Cisco enumerates your system.
Startupscan.dll
Windows being sus? Inconceivable!
CCM.exe (SCCM)
Windows Config Manager CCM.exe runs b64-encoded powershell.
Sophos Web Protection (sophosxl.net)
Do you like giant DNS queries? Sophos does.
LogMeIn and CScript
Who doesn't love CScript?
RingCentral.exe
How to look like malware, by RingCentral
Bloodhound.exe
Not the Bloodhound you're thinking of.
Noregon Fake Windows Components
Named after legitimate Windows binaries, in the wrong location.
Adobe Genuine Monitor Service
A little LSASS, as a treat.
Ivanti Endpoint Manager
Ivanti does some weird stuff
SentinelOne
EDRs 🤝 Malware Encoded PowerShell
Snow Inventory Agent for Windows
Yet another PowerShell weirdo.
Samsung MobileWips
Bizarre DNS requests on Samsung phones.
PanGpHip.exe
Palo Alto GP Firewall HIP check runs whoami.exe as SYSTEM.
ArcGISPortal.exe
Not just bad guys run whoami .
McAfee Antivirus
McAfee also loves big DNS queries!
ESET Protection Suite
Everybody loves a big DNS query!
EaseUS spaceman.exe
EaseUS and bizarre Scheduled Tasks.
AvastSvc.exe
Avast scans your network on the sly.
SenseNdr.exe
SenseNDR base64 encoding
HostedAgent.exe
Whoami? HostedAgent, of course!
iManage Document Protection
Random file extensions from iManage
gc_worker.exe
Base64-encoded PowerShell from Azure's own agent!
explorer.exe
Guests are not invited to Everyone shares.
Skype.exe
It runs whoami because it's lost.
SenseIR.exe
How much can an EDR look like malware?
Nutanix Guest Tools
Yet another base64-loving process.
Nim Lang install binaries
The Nim language installer binaries in certain versions trigger Windows Defender.
Windows TCP Connections on High Ports
Windows uses random high service ports for a variety of functions.
Edge/Chromium Browsers
Bizarre sub-processes.
Windows Terminal
Windows Terminal runs wsl on startup. Upon launch, Windows Terminal runs wsl --list to find potential Linux profiles to add to its list.
Network Detective Data Collector (nddc.exe)
WMIExec-ish NDCC
Adobe Reader (reader_sl.exe)
Adobe Reader for no reason starts a subprocess using the command line "I run".