Rule Info
Name
Potentially Suspicious Child Process of KeyScrambler.exe
Author
Swachchhanda Shrawan Poudel
Description
Detects potentially suspicious child processes of KeyScrambler.exe
Date
2024-05-13 00:00:00
Modified
None
Id
ca5583e9-8f80-46ac-ab91-7f314d13b984
Tags
attack.execution attack.defense_evasion attack.privilege_escalation attack.t1203 attack.t1574.002 DEMO
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Swachchhanda Shrawan Poudel
Merge PR #4818 from @swachchhanda000 - Add `Potentially Suspicious Child Process Of KeyScrambler.exe`
2024-05-13
Nasreddine Bencherchali
Merge PR #4482 From @nasbench - Add New Automation Workflows
2023-10-18
Nasreddine Bencherchali
Merge PR #4406 from @nasbench - Multiple Updates & Additions
2023-09-07
Scan your endpoints, forensic images or collected files with our portable scanner THOR