Windows Theme File Creation in Unusual Location — Detection Rule
Detects theme files being created in unusual locations. These files, used to customize desktop appearances, have been used for remote code execution and NTLM coercion attacks.
Detects theme files being created in unusual locations. These files, used to customize desktop appearances, have been used for remote code execution and NTLM coercion attacks.