Suspicious Service Installed

심각도 보통 Sigma 탐지 룰. Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders. Both services are used in the tool Ghost-In…

작성자: xknow (@xknow_infosec), xorxes (@xor_xes) · 원본 라이선스: DRL 1.1 · SigmaHQ 원본