Phoenix
Sigma IntelligenceBeta
Rule Library

Sigma Rules

145 rules found for "collection"

3,731Total
3,132Detection
457Emerging
139Hunting
Threat Huntmediumtest

Potentially Suspicious Compression Tool Parameters

Detects potentially suspicious command line arguments of common data compression tools

WindowsProcess Creation
TA0009 · CollectionT1560.001 · Archive via Utilitydetection.threat-hunting
Florian Roth (Nextron Systems)+1Tue Oct 15windows
‹1234›