LoFP
/
T1218.014
T1218.014
Title
Tags
legitimate applications may spawn powershell as a child process of the the identified processes. filter as needed.
t1021
t1021.003
t1021.006
t1047
t1053.005
t1059.001
T1218.014
t1543.003
endpoint
splunk
legitimate applications may trigger this behavior, filter as needed.
t1021
t1021.003
t1021.006
t1047
t1053
t1053.005
T1218.014
t1543
t1543.003
endpoint
splunk