HackTool - Koadic Execution via Command Line

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•90

Detects command line parameters indicative of Koadic hack tool execution. Specifically, it looks for 'cmd.exe' being executed with '/q', '/c', and 'chcp' in the command line, which is a known pattern used by Koadic for stager execution.