Execution Of Non-Existing File Or Unorthodox Process Start
This rule detects the execution of a process where the 'Image' field (representing the executable path) is not a full, absolute path. This behavior can be indicative of techniques like process ghosting or other methods used to start processes in an unorthodox way, often to evade detection. The rule specifically filters out null or empty image paths and common system processes to reduce false positives.
Sigma
