APT PRIVATELOG Image Load Pattern
Detects a specific image load pattern where 'svchost.exe' loads 'clfsw32.dll'. This pattern has been observed in the context of a tool named PRIVATELOG, which is associated with advanced persistent threat (APT) activities, and is considered rare under legitimate circumstances. This behavior could indicate process injection or other forms of defense evasion.
Sigma
