Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths

심각도 높음 Sigma 탐지 룰. Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument …

작성자: Nasreddine Bencherchali (Nextron Systems) · 원본 라이선스: DRL 1.1 · SigmaHQ 원본