Rule Library
Sigma Rules
2 rules found for "Swisscom CSIRT"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionhightest
MMC Spawning Windows Shell
Detects a Windows command line executable started from MMC
WindowsProcess Creation
Karneades+1Mon Aug 05windows
Detectionhightest
Potential Renamed Rundll32 Execution
Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection
WindowsProcess Creation
Nasreddine Bencherchali (Nextron Systems)Mon Aug 22windows