Dohdoor Process Hollowing
Detects legitimate Windows processes, known to be targeted by Dohdoor for process hollowing, making outbound network connections. This is highly indicative of the injected Dohdoor payload communicating with its C2 server.
Sigma
