Unattend.XML File Access Attempt

SigmaHQ Detections@sigmaHQ

•updated Jun 2, 2025•0•18

Detects attempts to access the "unattend.xml" file, which can contain sensitive credentials used during the unattended Windows installation process. Attackers may target this file to harvest credentials.