CodePage Modification Via MODE.COM To Russian Language

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•1

Detects a CodePage modification using the "mode.com" utility to Russian language. This behavior has been used by threat actors behind Dharma ransomware.