Phoenix
Sigma IntelligenceBeta
Rule Library

Sigma Rules

1 rule found for "CD_R0M_"

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionhightest

Custom File Open Handler Executes PowerShell

Detects the abuse of custom file open handler, executing powershell

WindowsRegistry Set
TA0005 · Defense EvasionT1202 · Indirect Command Execution
CD_R0M_Sat Jun 11windows