Suspicious svchost.exe Process Creation
Detects potential JabGopher activity where svchost.exe is spawned by an anomalous parent process for injection. This behavior aligns with the GopherWhisper APT execution chain, specifically injecting the LaxGopher backdoor.
CQL
