Suspicious WMIC Execution Via Office Process

심각도 높음 Sigma 탐지 룰. Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Offi…

작성자: Vadim Khrykov, Cyb3rEng · 원본 라이선스: DRL 1.1 · SigmaHQ 원본