All Detections

HackTool - DiagTrackEoP Default Named Pipe

avatar
SigmaHQ Detections@sigmaHQ
updated Aug 12, 2024000

Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.

Sigma