Rule Library
Sigma Rules
3 rules found for "Mangatas Tondang"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionmediumtest
Always Install Elevated Windows Installer
Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege
WindowsProcess Creation
Teymur Kheirkhabarov+2Tue Oct 13windows
Detectionmediumtest
Always Install Elevated MSI Spawned Cmd And Powershell
Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"
WindowsProcess Creation
Teymur Kheirkhabarov+2Tue Oct 13windows
Detectionmediumtest
Permission Check Via Accesschk.EXE
Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges
WindowsProcess Creation
Teymur Kheirkhabarov+3Tue Oct 13windows