Unsigned Generic Executable in Hola Directory
This rule detects the creation or modification of generic executable files (e.g., 'me.exe', 'update.exe') within the Hola installation directory. It specifically looks for executables whose names match common updater or service patterns and whose process command line includes 'hola', 'update', or 'installer'. This activity could indicate a compromised delivery pipeline or supply chain attack, as observed with the Hola browser.
Cortex XDR
