Phoenix
Sigma IntelligenceBeta

Search rules

Search the full rule library from any page.

    Open navigation menuClose navigation menu
    Rule Library

    Sigma Rules

    Browse detections by severity and log source, with YAML and sample events one click away.

    3,782Total
    3,164Detection
    474Emerging
    141Hunting
    1 rulesInspect a rule without leaving your results.
    highexperimentalEmerging Threat

    Lummac Stealer Activity - Execution Of More.com And Vbc.exe

    Detects the execution of more.com and vbc.exe in the process tree. This behavior was observed by a set of samples related to Lummac Stealer. The Lummac payload is injected into the vbc.exe process.

    windowsprocess_creation
    2024-12-19