Hide Navigation Hide TOC

Suspicious Speech Runtime Binary Child Process (78f10490-f2f4-4d19-a75b-4e0683bf3b8d)

Detects suspicious Speech Runtime Binary Execution by monitoring its child processes. Child processes spawned by SpeechRuntime.exe could indicate an attempt for lateral movement via COM & DCOM hijacking.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Suspicious Speech Runtime Binary Child Process (78f10490-f2f4-4d19-a75b-4e0683bf3b8d)	Sigma-Rules	System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	1
Suspicious Speech Runtime Binary Child Process (78f10490-f2f4-4d19-a75b-4e0683bf3b8d)	Sigma-Rules	Distributed Component Object Model - T1021.003 (68a0c5ed-bee2-4513-830d-5b0d650139bd)	Attack Pattern	1
Remote Services - T1021 (54a649ff-439a-41a4-9856-8d144a2551ba)	Attack Pattern	Distributed Component Object Model - T1021.003 (68a0c5ed-bee2-4513-830d-5b0d650139bd)	Attack Pattern	2