eScan CONSCTLX.exe Replacement Indicative of Persistent Payload
Detects replacement or modification of the eScan CONSCTLX.exe component located in C:\Program Files (x86)\eScan\. Replacing this binary may allow execution of a persistent next-stage payload under the guise of a trusted antivirus process.
Sigma
