Advanced Phishing Tradecraft 2026: Malicious MSI or SCR Execution From Fake Vide
Detects the execution of Windows Installer (.msi) files or screensaver (.scr) files that were recently downloaded and executed via a web browser. Attackers often use these file types as lures for fake updates or software installers to execute malicious code on the victim's system.
Sigma
