MITRE ATT&CK T1187 Detection Rules | Fibratus

Fibratus detection rules mapped to MITRE ATT&CK technique T1187. Kernel-level, behavior-driven detection coverage.

Back to all rules

Rules in this category

• Potential NTLM hash leak via MS Photos
• Potential NTLM hash leak via shortcut file