Sysinternals PsSuspend Suspicious Execution

심각도 높음 Sigma 탐지 룰. Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass …

작성자: Nasreddine Bencherchali (Nextron Systems) · 원본 라이선스: DRL 1.1 · SigmaHQ 원본