Skip to content
Threat Feed
Subscribe

Product

M365_defender

2 briefs RSS
high advisory

Lateral Movement via Remote Startup Folder Modification

Adversaries may achieve lateral movement by creating malicious files in remote Windows startup folders via RDP or SMB, leading to code execution upon system reboot or user logon.

m365_defender +4 lateral-movement persistence windows
2r 3t
high advisory

Suspicious Windows Command Shell Arguments Detection

This rule identifies the execution of the Windows Command Shell process (cmd.exe) with suspicious argument values, often observed during malware installation.

m365_defender +3 malware execution cmd
3r 2t