Skip to content
Threat Feed
Subscribe

Product

M365_defender

3 briefs RSS
high advisory

Lateral Movement via Remote Startup Folder Modification

Adversaries may achieve lateral movement by creating malicious files in remote Windows startup folders via RDP or SMB, leading to code execution upon system reboot or user logon.

m365_defender +4 lateral-movement persistence windows
2r 3t
high advisory

Suspicious Windows Command Shell Arguments Detection

This rule identifies the execution of the Windows Command Shell process (cmd.exe) with suspicious argument values, often observed during malware installation.

m365_defender +3 malware execution cmd
3r 2t
medium advisory

Unusual Service Host Child Process - Childless Service

This detection identifies unusual child processes of Service Host (svchost.exe) that traditionally do not spawn child processes, potentially indicating code injection or exploitation.

m365_defender +3 process_injection privilege_escalation defense_evasion windows
2r 2t