Potential ATM Jackpotting Activity
This rule detects suspicious process command-line activity on devices identified as ATMs. It looks for known malware-related executables (CSCSERVICE.EXE) and common ATM software components (DISPENSR, XFS, MSXFS, AGILIS, APTRA, PROCASH, *.xfs) being executed or initiated by unusual processes like svchost.exe, rundll32.exe, or regsvr32.exe. This activity could indicate an attempt at ATM jackpotting or other unauthorized access.
Microsoft Sentinel (KQL)
