Hunt : Windows Disable Windows Shutdown Button (T1112)
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Shutdown Button". No public in-the-wild intel reference available; correlate before alerting.
Sigma
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Shutdown Button". No public in-the-wild intel reference available; correlate before alerting.
Already have an account?