Windows Shell/Scripting Processes Spawning Suspicious Programs

심각도 높음 Sigma 탐지 룰. Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.

작성자: Florian Roth (Nextron Systems), Tim Shelton · 원본 라이선스: DRL 1.1 · SigmaHQ 원본