Process Hollowing or Blanketing Detected via Command Line
This rule detects potential process hollowing or process blanketing attempts by monitoring Windows Security Event ID 4688 (A new process has been created) and checking if the command line contains the strings 'ProcessHollowing' or 'ProcessBlanketing'. These strings in the command line of a newly created process could indicate an attempt to inject malicious code into a legitimate process to evade detection.
Microsoft Sentinel (KQL)
