Ursnif Discovery Command Redirection

SigmaHQ Detections@sigmaHQ

•updated Sep 2, 2024•0•22

Detects the redirection of discovery command output by the Ursnif malware. Specifically, it looks for `cmd.exe` processes spawned by `explorer.exe` that execute a command with `/C ` and redirect its output to a `.bin` file in the `AppData\local\temp\` directory.