System Modifications Parent topic

This section summarizes the system changes found after this threat was executed in a controlled environment. Threat Connect provides links to reports about threats that exhibit similar behavior.

Modified Components

Modified Component
Description
File and Folders
Observed changes to the file system after the threat was executed.
Hidden
Indicators of rootkit behavior, such as processes, services, and registry entries that were hidden after the threat was executed.
Processes and Modules
Processes that were added, modified or terminated after the threat was executed.
Registry
Registry keys and values that were added, modified or deleted after the threat was executed.
Service
Services that were added, deleted, started or stopped after the threat was executed.