Sigma Rules

Malware Shellcode in Verclsid Target Process

Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro