Operation Wocao Activity - checkadmin.exe Usage
Detects activity mentioned in the Operation Wocao report, specifically the use of 'checkadmin.exe' to enumerate local administrators. This tool is used by the threat actor to identify potential targets for privilege escalation or lateral movement.
Sigma
