hard20 pts · first answer countsdetection-engineeringsysmondetection-evasion
Catching a renamed binary
An attacker copies `procdump.exe` to `C:\ProgramData\svch0st.exe` and dumps memory. Your rule checks `Image|endswith: '\procdump.exe'`. Which change makes it resilient to the rename?
Discussion 0
Join free to post in the discussion.
Related questions
- False positive or false negative?Cybersecurity Analyst
- What is Sysmon Event ID 1?Cybersecurity Analyst
- What detection as code gives youCybersecurity Analyst
- The logsource block in a Sigma ruleCybersecurity Analyst
- Reading a selection and filter conditionCybersecurity Analyst
- What the contains modifier doesCybersecurity Analyst
- Why match Image with endswithCybersecurity Analyst
- Reading an ATT&CK ID like T1059.001Cybersecurity Analyst