DragonForce Locker SID Enumeration Debug String

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•4

This rule detects the execution of processes that contain the command line argument 'Found sid:', which is commonly associated with security identifier (SID) enumeration or lookup tools/scripts, such as those used by security researchers or attackers during reconnaissance.