OpenWith.exe Executes Specified Binary
Detects when OpenWith.exe is used to execute another binary, indicated by the presence of '/c' in the command line. This technique can be used by adversaries to bypass process and/or signature-based defenses by proxying execution with a trusted binary.
Sigma
