Potential Persistence Via Security Descriptors - ScriptBlock

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially set a backdoor. As seen used in the DAMP project.