Suspicious Unsigned Thor Scanner Execution
Detects the loading and execution of an unsigned Thor scanner binary. This rule specifically looks for 'thor.exe' or 'thor64.exe' being loaded, and then filters out instances where the binary is legitimately signed by 'Nextron Systems GmbH' with a valid signature status. This helps identify potentially malicious or unauthorized versions of the Thor scanner.
Sigma
