Phoenix
Sigma IntelligenceBeta
Rule Library

Sigma Rules

1 rule found for "Ivan Dyachkov"

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionmediumtest

DLL Execution Via Register-cimprovider.exe

Detects using register-cimprovider.exe to execute arbitrary dll file.

WindowsProcess Creation
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionT1574 · Hijack Execution Flow
Ivan Dyachkov+2Wed Oct 07windows