Potential DLL Injection or Execution Using Tracker.exe
This rule detects potential DLL injection or execution attempts using 'Tracker.exe', a legitimate Microsoft binary that can be abused. The detection specifically looks for 'Tracker.exe' being executed with command-line arguments '/d' or '/c', which are indicative of its use in loading or executing DLLs. It filters out common false positives related to MSBuild processes.
Sigma
