Hide Navigation Hide TOC

Process Monitor Driver Creation By Non-Sysinternals Binary (a05baa88-e922-4001-bc4d-8738135f27de)

Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Process Monitor Driver Creation By Non-Sysinternals Binary (a05baa88-e922-4001-bc4d-8738135f27de)	Sigma-Rules	Exploitation for Privilege Escalation - T1068 (b21c3b2d-02e6-45b1-980b-e69051040839)	Attack Pattern	1