mitre att&ck technique
T1204.004
Malicious Copy and Paste
2 posts cover this technique
-
The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion
A memory-acquisition alert led back 17 hours to a KongTuke-style delivery chain, a portable Node.js RAT with Ethereum-based C2 resolution, WinRM enablement, and an attempted upload of a memory image to cloud storage.
-
Browser History for Initial Access: Collecting and Querying Chromium History
When the EDR shows PowerShell or a suspicious download but not how the user got there, the browser's SQLite history usually does. Find the right profile, collect a copy, and query it in DB Browser for SQLite.