DeviceCredentialDeployment.exe Execution for Defense Evasion

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects the execution of 'DeviceCredentialDeployment.exe', a legitimate Windows binary that can be abused to hide processes from view. This technique is often used for defense evasion.