New Assemblies Installed Via Gacutil.EXE

Rule Info

Name
New Assemblies Installed Via Gacutil.EXE
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects the addition of new assemblies to the global assembly cache (GAC) via the the "Gacutil" utility
Reference
https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
Date
2023-02-01 00:00:00
Modified
None
Id
7e73ac9d-0178-4e77-a68c-ce83aba8461d
Tags
attack.execution attack.t1059
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022