Suspicious Process Chains - PowerShell Spawning Fontdrvhost
Detects instances where PowerShell spawns the fontdrvhost.exe process. This parent-child relationship is highly anomalous and is indicative of process injection, as seen in the final stage of the ClipBanker malware execution chain.
Sigma
