T1210

[frack113]

https://attack.mitre.org/techniques/T1210/

sigma:
builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml: - attack.t1210
builtin/system/netlogon/win_system_possible_zerologon_exploitation_using_wellknown_tools.yml: - attack.t1210
dns_query/dns_query_win_quickassist.yml: - attack.t1210
process_creation/proc_creation_win_hktl_sharpwsus_wsuspendu_execution.yml: - attack.t1210
process_creation/proc_creation_win_java_sysaidserver_susp_child_process.yml: - attack.t1210
process_creation/proc_creation_win_svchost_termserv_proc_spawn.yml: - attack.t1210