Suspicious RASdial Process Creation
Detects the creation of a process named 'rasdial.exe'. This executable is used to establish and manage dial-up network connections, but can also be abused by adversaries for various purposes, including establishing C2 communication or exfiltration channels, or for defense evasion by creating unexpected network connections.
Sigma
