hightestEmerging Threat
Ps.exe Renamed SysInternals Tool
Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report
windowsprocess_creation
2023-05-02
Emerging Threats
Actor2017
Dragonfly
1Rules
1References
1Folders
2023-05-02Latest
Summary
Dragonfly is tracked here as a threat actor, intrusion set, or campaign with 1 Sigma detection spanning 2017. Coverage centers on windows / process_creation.
Related Detections
Search this threatReferences