Rule Library
Sigma Rules
3 rules found for "Swisscom CSIRT"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionhightest
MMC Spawning Windows Shell
Detects a Windows command line executable started from MMC
WindowsProcess Creation
Karneades+1Mon Aug 05windows
Detectionhightest
Potential Renamed Rundll32 Execution
Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection
WindowsProcess Creation
Nasreddine Bencherchali (Nextron Systems)Mon Aug 22windows
Emerging Threathighstable
Trickbot Malware Activity
Detects Trickbot malware process tree pattern in which "rundll32.exe" is a parent of "wermgr.exe"
WindowsProcess Creation
Florian Roth (Nextron Systems)Thu Nov 262020