Phoenix
Sigma IntelligenceBeta
Rule Library

Sigma Rules

1 rule found for "vburov"

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionlowtest

Windows Processes Suspicious Parent Directory

Detect suspicious parent processes of well-known Windows processes

WindowsProcess Creation
TA0005 · Defense EvasionT1036.003 · Rename System UtilitiesT1036.005 · Match Legitimate Name or Location
vburovSat Feb 23windows