Skip to content

Commit

Permalink
Merge pull request #2 from Apro123/Readme-misspell-patch-1
Browse files Browse the repository at this point in the history
updated readme fixing misspelling
  • Loading branch information
Apro123 authored May 26, 2021
2 parents 99f597f + 419fa9a commit 3eef9ba
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ We see ransomware delete all shadow copies using `vssadmin` pretty often. What i

We [register a debugger](https://attack.mitre.org/techniques/T1546/012/) for `vssadmin.exe` (and `wmic.exe`), which is our compiled `raccine.exe`. Raccine is a binary, that first collects all PIDs of the parent processes and then tries to kill all parent processes.

Avantages:
Advantages:

- The method is rather generic
- We don't have to replace a system file (`vssadmin.exe` or `wmic.exe`), which could lead to integrity problems and could break our raccination on each patch day
Expand Down

0 comments on commit 3eef9ba

Please sign in to comment.