attack.t1134 | Detection.FYI

Suspicious SYSTEM User Process Creation

Aug 28, 2023 · attack.credential_access attack.defense_evasion attack.privilege_escalation attack.t1134 attack.t1003 attack.t1027 ·
Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Read More
Detection of Possible Rotten Potato

Apr 21, 2023 · attack.privilege_escalation attack.t1134 attack.t1134.002 ·
Share on:

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE privileges

Read More