Rare-process-as-a-service
This query is looking for rarely seen processes which are launched as a service. Author: Jouni Mikkola More info: https://threathunt.blog/rare-process-launch-as-a-service/
Microsoft Sentinel (KQL)

This query is looking for rarely seen processes which are launched as a service. Author: Jouni Mikkola More info: https://threathunt.blog/rare-process-launch-as-a-service/

Already have an account?