Rule Library

Sigma Rules

1 rule found for "Matthew Matchen"

3,707Total

3,116Detection

451Emerging

137Hunting

Filters

Type

Severity

Status

Product

Category

Detectionhightest

File Download Via Windows Defender MpCmpRun.EXE

Detects the use of Windows Defender MpCmdRun.EXE to download files

WindowsProcess Creation

TA0005 · Defense EvasionT1218 · System Binary Proxy ExecutionTA0011 · Command and ControlT1105 · Ingress Tool Transfer

Matthew MatchenFri Sep 04windows