TA584 XWorm RegSvcs Process Hollowing
Detects PowerShell launching RegSvcs.exe, a technique used by TA584 to deliver the 'P0WER' variant of XWorm via process hollowing. The 'P0WER' variant of XWorm uses a custom .NET loader that starts RegSvcs.exe in a suspended state, which is a strong indicator of process hollowing. Legitimate use of RegSvcs.exe by developers is possible but uncommon from PowerShell.
Microsoft Sentinel (KQL)
