SysmonEOP Execution for CVE-2022-41120 Exploitation

SigmaHQ Detections@sigmaHQ

•updated Nov 25, 2024•0•12

Detects the execution of a Proof-of-Concept (PoC) tool named 'SysmonEOP.exe' or a variant identified by specific IMPHASH values. This tool is designed to exploit CVE-2022-41120, a vulnerability in Sysmon that can lead to privilege escalation.