Explorer Process Tree Break

심각도 보통 Sigma 탐지 룰. Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it brea…

작성자: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber · 원본 라이선스: DRL 1.1 · SigmaHQ 원본