nccgroup/uninstalledappcanaryA Canary which fires when uninstalled
基于围绕Windows服务金丝雀的欺骗工程工作 https://research.nccgroup.com/2021/03/04/deception-engineering-exploring-the-use-of-windows-service-canaries-against-ransomware/
某些威胁行为者在投放后续阶段之前会卸载一系列产品。我们部署了多个金丝雀应用程序，它们在以相关名称卸载时触发。
在2021年Microsoft Exchange战争期间，我们观察到威胁行为者使用以下技术
cmd /c start /b wmic.exe product where "name like '%Eset%'" call uninstall /nointeractive
cmd /c start /b wmic.exe product where "name like '%%Kaspersky%%'" call uninstall /nointeractive
cmd /c start /b wmic.exe product where "name like '%avast%'" call uninstall /nointeractive
cmd /c start /b wmic.exe product where "name like '%avp%'" call uninstall /nointeractive
cmd /c start /b wmic.exe product where "name like '%Security%'" call uninstall /nointeractive
cmd /c start /b wmic.exe product where "name like '%AntiVirus%'" call uninstall /nointeractive
cmd /c start /b wmic.exe product where "name like '%Norton Security%'" call uninstall /nointeractive
编辑Security.vdproj并将REPLACEME替换为
"Arguments" = "8:REPLACEME.canarytokens.com"
https://github.com/nccgroup/UninstalledAppCanary/blob/main/Security/Security.vdproj#L69