Trojan Process Hash Detection

Ankit Mehta@Secvyn

•updated Jun 17, 2026•1•0•2

This rule detects the creation of processes with specific, known malicious hashes (identified as 'ProcessId' in the rule logic, but likely representing image hashes). It monitors Windows Security Event Log (EventID 4688) for process creation events and triggers when a process's identifier matches one of the predefined indicators of compromise (IOCs). This indicates the execution of a known Trojan or other malicious software.