Suspicious VSLauncher Execution from SysWOW64
Detects the execution of VSLauncher.exe (Microsoft Visual Studio Version Selector) from the SysWOW64 directory. This behavior is highly anomalous and indicates potential DLL sideloading of input.dll (PassMark Endpoint) by threat actors such as UAC-0184 to repurpose a signed binary's network stack.
Sigma
