Lolbin Runexehelper Use As Proxy
Detects the execution of 'runexehelper.exe' as a parent process, indicating its use as a proxy to launch other programs. This technique is often used for defense evasion by leveraging a legitimate, signed binary to execute malicious code.
Sigma
