Evasive Panda Fake SohuVA Updater Execution
The rule detects the execution of a suspicious executable named 'sohuva_update_*.exe' from user-writable or download paths (Temp, Downloads, AppData, or ProgramData\Microsoft\MF). This execution is considered suspicious if its parent process is typically a web browser or explorer.exe, or if the parent process itself originates from one of these suspicious paths. The rule explicitly excludes legitimate executions of 'sohuva_update_*.exe' from standard 'Program Files' directories associated with Sohu installations.
Sigma
