Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Operation Wocao Activity - Security

Yamato Security Hayabusa@YamatoSecurityHayabusa

•updated Jun 24, 2025•0•5

Detects activity mentioned in Operation Wocao report

Sigma

Tags

TA0007 - Discovery T1012 - Query Registry TA0005 - Defense Evasion T1036.004 - Masquerade Task or Service T1027 - Obfuscated Files or Information TA0002 - Execution T1053.005 - Scheduled Task T1059.001 - PowerShell TA0003 - Persistence TA0004 - Privilege Escalation Windows Windows Eventlog Securityattack.discoveryattack.t1012attack.defense-evasionattack.t1036.004attack.t1027attack.executionattack.t1053.005attack.t1059.001detection.emerging-threats

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?