AutoJack RCE - AutoGen Studio Spawning LOLBins
Detects AutoGen Studio spawning Living-off-the-Land binaries (LOLBins) used for execution or payload retrieval. This rule specifically looks for processes initiated by 'autogenstudio' that then execute 'certutil.exe', 'mshta.exe', 'regsvr32.exe', or 'rundll32.exe'.
Microsoft Sentinel (KQL)
