Potential Adplus.exe Abuse for Credential Dumping or Command Execution
Detects the execution of "AdPlus.exe", a legitimate Windows SDK binary that can be abused as a Living Off The Land Binary (LOLBIN) to dump process memory (potentially including LSASS) or execute arbitrary commands. The rule specifically looks for command-line arguments indicative of these malicious uses, such as dumping process memory, using a config file, or executing inline commands.
Sigma
