2023-06-21 07:31:39 +00:00
|
|
|
# BlackLotus_Ioc_scan_Powershell
|
|
|
|
|
|
2023-06-21 07:49:51 +00:00
|
|
|
Powershell script(s) to scan windows PC for published IoCs of BlackLotus bootkit documented by Eset and Microsoft
|
|
|
|
|
|
|
|
|
|
https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/
|
|
|
|
|
|
|
|
|
|
https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
|
|
|
|
|
|
|
|
|
|
Usage:
|
2023-06-21 07:50:00 +00:00
|
|
|
|
2023-06-21 07:54:45 +00:00
|
|
|
Open Powershell (as Admin) and run:
|
|
|
|
|
|
|
|
|
|
.\Black-Lotus_check.ps1
|
|
|
|
|
|
|
|
|
|
|
2023-06-21 08:05:35 +00:00
|
|
|
|
2023-06-21 07:56:20 +00:00
|
|
|
|
2023-06-21 07:49:51 +00:00
|
|
|
|
