PDFSIDER Hidden Command Shell Execution

g host@ghosty

•updated Jan 20, 2026•38•0•275

This rule detects the creation of a hidden command shell by the 'pdf24.exe' process, a behavior associated with the PDFSIDER malware. Specifically, it looks for 'cmd.exe' being spawned with the '/c' argument by 'pdf24.exe'.