Rule Library
Sigma Rules
3 rules found for "Trent Liffick"
3,731Total
3,132Detection
457Emerging
139Hunting
Emerging Threathightest
Lazarus System Binary Masquerading
Detects binaries used by the Lazarus group which use system names but are executed and launched from non-default location
WindowsProcess Creation
Trent Liffick+1Wed Jun 032017
Emerging Threathightest
Blue Mockingbird
Attempts to detect system changes made by Blue Mockingbird
WindowsProcess Creation
Trent LiffickThu May 142020
Emerging Threathightest
Blue Mockingbird - Registry
Attempts to detect system changes made by Blue Mockingbird
WindowsRegistry Set
Trent LiffickThu May 142020