Tool
ARest1.exe
- First Reported
- Nov 25, 2024
- Latest Reported
- Nov 25, 2024
Reported Context (1)
- SOC had responded to a Defender alert for credential dumping, which blocked “avrestore.exe” and “ARest1.exe.” These binaries were determined not to be mimikatz but, in fact, part of a previously documented tool Huntress Links Two RDP-Brute-Force Intrusions to Renamed MeshAgent Persistence
People (5)
MITRE ATT&CK (6)
Vendors (1)
Products (3)
Tools (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.