Hidden Executable In NTFS Alternate Data Stream

심각도 보통 Sigma 탐지 룰. Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash

작성자: Florian Roth (Nextron Systems), @0xrawsec · 원본 라이선스: DRL 1.1 · SigmaHQ 원본