Cryptojacking via ScreenConnect - Process Hollowing InstallUtil

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•5

Advanced detection correlating RuntimeHost.exe spawning suspended InstallUtil.exe to inject miner. This rule specifically looks for 'RuntimeHost.exe' initiating 'InstallUtil.exe' without command-line arguments, followed by network activity from the 'InstallUtil.exe' process, indicating potential process hollowing and cryptojacking.