Anomalous svchost.com Execution_MuddyWater Operation Olalampo Campaign
Detects the execution of an executable named 'svchost.com' from the 'C:\Windows\' directory. This is a known persistence and masquerading technique used by the threat actor MuddyWater. The legitimate Windows process is 'svchost.exe' and is located in the System32 directory.
Microsoft Sentinel (KQL)
