Suspicious TSCON Start as SYSTEM (9847f263-4a81-424f-970c-875dab15b79b)
Detects a tscon.exe start as LOCAL SYSTEM
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Suspicious TSCON Start as SYSTEM (9847f263-4a81-424f-970c-875dab15b79b) | Sigma-Rules | Remote Access Software - T1219 (4061e78c-1284-44b4-9116-73e4ac3912f7) | Attack Pattern | 1 |