Bad Opsec Defaults: Sacrificial Processes With Improper Arguments
Detects attackers using tooling with bad operational security (opsec) defaults, specifically when spawning sacrificial processes like WerFault.exe, rundll32.exe, regsvcs.exe, regasm.exe, or regsvr32.exe without expected arguments. This behavior is often indicative of process injection or other malicious activities where the attacker fails to mimic legitimate process execution, making it easier to detect. Examples include Cobalt Strike's default use of rundll32.exe without arguments or the Kraken attack abusing WerFault without arguments.
Sigma
