Sigma Rules

Potential BearLPE Exploitation

Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write\par