Phoenix
Sigma IntelligenceBeta
Rule Library

Sigma Rules

1 rule found for "Hai Vaknin"

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionmediumtest

Suspicious Driver Install by pnputil.exe

Detects when a possible suspicious driver is being installed via pnputil.exe lolbin

WindowsProcess Creation
TA0004 · Privilege EscalationTA0003 · PersistenceT1547 · Boot or Logon Autostart Execution
Hai Vaknin+2Thu Sep 30windows