Changelog

1.17.1

Features:

Detection for SetupExecuteNoPnpSync
Enhanced detection for techniques implemented in 1.17.1 (expanded search outside of System32 - credit @sixtyvividtails)

1.17.0

Features:

Detection for BootExecute and BootExecuteNoPnpSync
Detection for PlatformExecute
Detection for SetupExecute
Detection for Netsh Helper DLL

1.16.3

Fixes:

Fixed a bug in the remote computer execution which, under certain circumstances, prevented the proper execution of the module

1.16.2

Fixes:

Fixed a bug in the remote computer execution which, under certain circumstances, prevented the proper execution of the module
Fixed a bug in the handling of the LSA Notification Package detection (see PR #27)

1.16.1

Fixes:

Fixed a bug in the Ghost Task function which under certain circumstances prevented the detection of the technique

1.16.0

Features:

Detection for the BootVerificationProgram hijacking
Detection for the AppInit DLLs injection Fixes:
Fixed a false positive in the detection of the Suborner Attack caused by a faulty implementation of the Parse-NetUser internal function

1.15.1

Fixes:

Fixed a gap in the detection of the techniques which relied on Get-IfSafeExecutable function which would prevent Powershell persistences from showing up

1.15.0

Features:

Detection for the GhostTask technique Fixes:
Fixed some minor bugs

1.14.0

Features:

Detection for the DSRM backdoor Fixes:
Fixed a bug regarding the Parse-NetUser internal function (see issue #20).

1.13.0

Features:

Detection for RID hijacking
Detection for the Suborner technique Fixes:
Fixed a bug regarding module-wide string comparisons (see issue #19).

1.12.1

Fixes:

Fixed a bug which prevented the detection of the Utilman.exe hijacking in the Accessibility Tools persistence detection.

1.12.0

Features:

Save results to the local Windows Event Log Fixes:
Fixed a bug which saw OutputCSV contain the techniques that should have been filtered out by DiffCSV.

1.11.0

Features:

Detection for RunEx registry key added
Detection for RunOnceEx registry key added
Detection for .NET startup hooks added Fixes:
Fixed a bug which prevented the detection of CmdAutoRun from working as intended.

1.10.1

Fixes:

Fixed a bug which prevented -DiffCSV from working as intended.

1.10.0

Features:

Detection for Office AI.exe hijacking
Detection for Service Control Manager Security Descriptor tampering
Detection for Explorer Context Menu hijacking Fixes:
Fixed handling of system environment variables in the registry
Fixed the bug in which the script blocked if one of the remote computers was not reachable

1.9.3

Features:

Added the possibility of passing a Virustotal API key and check if the hash of the detected file is known.
Malicious Office Templates are now detected
New license has been implemented.

1.9.2

Fixes:

Fixed 3 lines of code dealing with minor bugs

1.9.1

Features:

Added the following persistence techniques:
- Screensaver
- BITS JOb NotifyCmdLine
- Power Automate

1.8.0

Features:

Added the following persistence techniques:
- AMSI Providers
- Powershell Profiles
- Silent Exit Monitor
- Telemetry Controller Commands
- RDP WDS Startup Programs
- Scheduled Tasks Fixes:
Fixed minor typos here and there

1.7.1

Fixes:

the PSM1 is now also signed (it was not in v1.7.0)

1.7.0

Features:

add support for accessibility tools backdoor detection

1.6.0

Features:

add support for RDP InitialProgram detection

1.5.0

Features:

added the PersistenceMethod parameter in order to selectively check for one persistence technique at a time

1.4.0

Features:

the module is now digitally signed with a valid code signing certificate

1.3.1

Features:

a number of new persistence checks have been implemented

1.0

Features:

WMI event subscriptions persistence check has been implemented

0.9

Beta release