UEFI Persistence Via Wpbbin File Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•27

Detects the creation of a file named "wpbbin.exe" in the "C:\Windows\System32\" directory. This activity can be indicative of a UEFI-based persistence method used by adversaries to maintain access to a system, often by injecting executable files into the boot process, potentially bypassing security measures like BitLocker.