Process Creation Using Sysnative Folder (3c1b5fb0-c72f-45ba-abd1-4d4c353144ab)
Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d) | Attack Pattern | Process Creation Using Sysnative Folder (3c1b5fb0-c72f-45ba-abd1-4d4c353144ab) | Sigma-Rules | 1 |