Potetial Backdoor Services Dism
Detects the enabling/installing of services and applications via DISM.exe. Exclude IT workers, and look for baseline of all users leveraging DISM.
YARA
Detects the enabling/installing of services and applications via DISM.exe. Exclude IT workers, and look for baseline of all users leveraging DISM.
Already have an account?