proc_creation_win_malware_plugx_susp_exe_locations

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•27

Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location