SearchProtocolExecution
Detects execution of processes containing 'search' or 'search-ms' in command line with 'crumb=location' parameter.
YARA-L

Detects execution of processes containing 'search' or 'search-ms' in command line with 'crumb=location' parameter.

Already have an account?