Windows Process Injection In Non-Service SearchIndexer

The analytic identifies instances of the `searchindexer.exe` process that are not spawned by `services.exe`, indicating potential process injection. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes. This activity is significant because QakBot malware often uses a fake `searchindexer.exe` to evade detection and perform malicious actions such as data exfiltration and keystroke logging. If confirmed malicious, this activity could allow attackers to maintain persistence, steal sensitive information, and communicate with command and control servers.