Rule Library
Sigma Rules
2 rules found for "AdmU3"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionlowtest
Compressed File Creation Via Tar.EXE
Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration.
WindowsProcess Creation
Nasreddine Bencherchali (Nextron Systems)+1Tue Dec 19windows
Detectionlowtest
Compressed File Extraction Via Tar.EXE
Detects execution of "tar.exe" in order to extract compressed file. Adversaries may abuse various utilities in order to decompress data to avoid detection.
WindowsProcess Creation
AdmU3Tue Dec 19windows