Operation DragonReturn MixedSvc Masquerading in Windows Media Player Directory
Detects unsigned or non-Microsoft signed executables running from the Windows Media Player installation directory. This behavior is indicative of masquerading techniques used by attackers, such as the Operation DragonReturn campaign, to hide malicious services or components within trusted system directories.
Sigma
