Modified Component
|
Description
|
---|---|
File and Folders
|
Observed changes to the file system after
the threat was executed.
|
Hidden
|
Indicators of rootkit behavior, such as
processes, services, and registry entries that were hidden after
the threat was executed.
|
Processes and Modules
|
Processes that were added, modified or terminated
after the threat was executed.
|
Registry
|
Registry keys and values that were added,
modified or deleted after the threat was executed.
|
Service
|
Services that were added, deleted, started
or stopped after the threat was executed.
|