Kavremover Dropped Binary LOLBIN Usage
Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a Living Off The Land Binary (LOLBIN) to execute arbitrary commands and binaries. The rule specifically looks for command lines containing ' run run-cmd ' and excludes executions where the parent process is 'cleanapi.exe' or 'kavremover.exe', as these are legitimate parent processes for the dropped binary.
Sigma
