Phoenix
Sigma IntelligenceBeta
Rule Library

Sigma Rules

1 rule found for "CD_R0M_"

3,731Total
3,132Detection
457Emerging
139Hunting
Detectionhightest

Custom File Open Handler Executes PowerShell

Detects the abuse of custom file open handler, executing powershell

WindowsRegistry Set
CD_R0M_Sat Jun 11windows