PUA - RemCom Default Named Pipe Creation
Detects the creation of a named pipe with the default name used by RemCom, a legitimate remote administration tool that can be abused by attackers for lateral movement and execution.
Sigma
Detects the creation of a named pipe with the default name used by RemCom, a legitimate remote administration tool that can be abused by attackers for lateral movement and execution.
Already have an account?