T1212 #150
Description
https://attack.mitre.org/techniques/T1212/
sigma:
builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml: - attack.t1212
builtin/security/win_security_susp_kerberos_manipulation.yml: - attack.t1212
process_creation/proc_creation_win_rundll32_ntlmrelay.yml: - attack.t1212