DeadVax Process Injection into Trusted Targets
Malware often tries to hide inside programs that users trust. In this attack, it runs its code inside Windows apps like OneDrive, RuntimeBroker, or similar system processes. These apps are signed by Microsoft and run in the background, so they attract less attention. The malware uses PowerShell to put its code into those processes. Once inside, the malicious code runs as if it were part of the trusted app. This makes it harder for security tools and users to spot. Normal use of these apps does not involve PowerShell accessing them in this way. Security teams should treat PowerShell or a renamed PowerShell accessing these specific processes as a strong sign of an attack. This rule helps detect that behaviour.
Sigma
