Code Page Modification to Russian Language via MODE.COM

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•0•13

Detects the modification of the system's code page to Russian language (code page 1251 or 866) using the `mode.com` utility. This activity has been observed in attacks involving Dharma ransomware and other malware.