ATT&CK technique
View on MITRE ATT&CK →
T1588.002
Tool
Resource Development
13 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Windows NirSoft AdvancedRun | deprecated | 2026-10-09 |
| splunk | Windows NirSoft Utilities | production | 2026-10-09 |
| splunk | Cisco Secure Firewall - Connection to File Sharing Domain | production | 2026-10-08 |
| splunk | Windows NirSoft Tool Bundle File Created | production | 2026-10-01 |
| sigma | Usage of Renamed Sysinternals Tools - RegistrySet | test | 2026-06-29 |
| sigma | Suspicious Execution Of Renamed Sysinternals Tools - Registry | test | 2026-06-29 |
| sigma | PUA - Sysinternals Tools Execution - Registry | test | 2025-10-26 |
| sigma | PUA - Sysinternal Tool Execution - Registry | test | 2025-10-26 |
| sigma | Hacktool Execution - Imphash | test | 2024-11-23 |
| sigma | Potential Execution of Sysinternals Tools | test | 2024-03-13 |
| sigma | Hacktool Execution - PE Metadata | test | 2024-01-15 |
| sigma | Suspicious Keyboard Layout Load | test | 2023-08-17 |
| sigma | Renamed SysInternals DebugView Execution | test | 2023-02-14 |