RE Tooling Execution Targeting EDR Sensor Binaries (Ghidra/BinaryNinja/IDA)
Detects the execution of reverse engineering tools like Ghidra, Binary Ninja, or IDA Pro when their command-line arguments reference paths or names associated with EDR sensor drivers, binaries, or services. This behavior is indicative of an adversary conducting analysis of security software to identify potential blind spots or tampering opportunities.
Sigma
