UNG0902 DUPERUNNER Process Injection
Detects the DUPERUNNER implant injecting shellcode into common legitimate Windows processes like explorer.exe, notepad.exe, or msedge.exe. This behavior is associated with the UNG0902 threat actor as part of the Operation DupeHike campaign.
YARA-L
