Rule Info
Name
Renamed SharpNBTScan.EXE Execution
Author
X__Junior (Nextron Systems)
Description
Detects the execution of a renamed "SharpNBTScan.exe". Often used by the attackers to perform scanning in the environment/.
Reference
Date
2024-09-10 00:00:00
Modified
None
Id
544bee8b-832f-4c5e-bb7d-ce8ce0ec5a5a
Tags
attack.impact attack.t1486
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR