t1564.001 | LoFP

t1564.001

Title	Tags
igfxcuiservice.exe hiding *.cui files via .bat script (attrib.exe a child of cmd.exe and igfxcuiservice.exe is the parent of the cmd.exe)	t1564 t1564.001 windows sigma
legitimate use	t1005 t1040 t1059 t1072 t1090 t1124 t1127 t1219 t1484 t1484.001 t1546 t1546.015 t1555 t1555.003 t1562 t1562.001 t1564 t1564.001 windows sigma
msiexec.exe hiding desktop.ini	t1564 t1564.001 windows sigma
none at the moment	t1564.001 endpoint splunk