Unusual File Modification by dns.exe

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•34

Detects unexpected file modifications by 'dns.exe', which could indicate remote code execution or other exploitation, specifically referencing CVE-2020-1350 (SigRed). The rule filters out modifications to 'dns.log' to reduce false positives.