Potential Persistence Via DLLPathOverride

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistence which will get invoked by "SearchIndexer.exe" process