Elise Backdoor Activity Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•38

Detects Elise backdoor activity, specifically looking for the creation of a svchost.exe process in a suspicious path and the deletion of a NavShExt.dll file, which are indicators of the Elise malware used by APT32.