Potential Provlaunch.EXE Binary Proxy Execution Abuse

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

Detects child processes of 'provlaunch.exe' which might indicate potential abuse to proxy execution. Adversaries may use 'provlaunch.exe', a legitimate Windows binary, to execute arbitrary commands or binaries, bypassing security controls or masquerading malicious activity.