Threat actors are abusing Microsoft Teams voice calls by impersonating corporate IT support staff to trick employees into ...

description: The following analytic identifies modifications to registry keys commonly used for persistence mechanisms. It leverages data from endpoint detection sources like Sysmon or Carbon Black, ...

已知限制 / 待办 跨平台：tasklist/ taskkill与 cmd.exe/ powershell.exe硬编码，macOS / Linux 需改用 pgrep/ kill与对应 shell。 env字段：当前无法为启动进程注入环境变量（如 PYTHONUTF8=1）。 Windows 下 python 服务打印中文可能触发 GBK 编码错误，需先设置系统 / 用户环境变量。