1 post
Jun 28, 2020
This article discusses an interesting tactic (CVE-2020-1464) actively used by different Java RAT malware authors like Ratty & Adwind to distribute malicious JAR appended to signed MSI files.
One lab-proven detection per issue: the attacker command, the telemetry it leaves, and the KQL / ES|QL that catches it.
You confirm on Substack in one tap.
No spam. Unsubscribe anytime.
