Darkcloud Process Hollowing MSbuild Mtstocom
Detects when a legitimate Windows binary, MSBuild.exe or mtstocom.exe, initiates an outbound network connection. This behavior is not typical for these processes and is a technique used by malware like DarkCloud to evade defenses by process hollowing.
YARA-L
