UNC2452 Process Creation Patterns

SigmaHQ Detections@sigmaHQ

•updated Sep 13, 2024•0•27

Detects specific process creation patterns associated with UNC2452 (SolarWinds Compromise) activity, as identified by Microsoft Defender ATP queries. This includes the use of 7-Zip for archiving, wscript.exe executing VBS scripts, and rundll32.exe for DLL execution, often involving specific command-line arguments and parent-child relationships.