084. Detecting Ransomware Affiliate's Toolkit: PCHunter
Hello everyone! I've compiled a list of tools abused by ransomware affiliates for defense evasion, and plan to cover every tool in the blog. Today we'll talk about PCHunter . This is another tool leveraged by adversaries for identification of processes related to security products, and terminating them. As always, let's start from binary detection: event_type: "processcreatewin" AND proc_file_originalfilename: "PCHunter.exe" Also, you can search for related DNS requests: event_type: "dnsreq" AND dns_rname: "epoolsoft.com" Finally, it's a good idea to search for PCHunter's driver file creation events: event_type: "filecreatewin" AND file_path: ("PCHunter" AND "sys") As always, here's a sample . See you tomorrow!