The more I learned MOD, the more excuses I found to use it.
description: The following analytic identifies child processes spawned from "mshta.exe". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific child processes like ...
description: The following analytic detects the creation of new accounts elevated to local administrators. It uses Windows event logs, specifically EventCode 4720 (user account creation) and EventCode ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results