Suspicious CodePage Switch Via CHCP

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•15

Detects the use of 'chcp.com' to switch the system's active code page to a less common or potentially suspicious language, which could be used for defense evasion or to support specific malware functionalities.