Potentially Suspicious NTFS Symlink Behavior Modification

심각도 보통 Sigma 탐지 룰. Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote syml…

작성자: frack113, The DFIR Report · 원본 라이선스: DRL 1.1 · SigmaHQ 원본