Suspicious Sysmon as Execution Parent

심각도 높음 Sigma 탐지 룰. Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-202…

관련 CVE: CVE-2022-41120

작성자: Florian Roth (Nextron Systems), Tim Shelton (fp werfault) · 원본 라이선스: DRL 1.1 · SigmaHQ 원본