Sdclt Child Processes

SigmaHQ Detections@sigmaHQ

•updated Nov 27, 2021•0•0•1

A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.