GoToMeeting Process Initiates Network Activity after Local DLL Loading
Detects G2M.exe making external connections shortly after loading a local g2m.dll, providing behavioural confirmation that the trusted binary has been repurposed. This rule specifically looks for network activity from G2M.exe when its process image path is located in suspicious directories like AppData, Temp, Downloads, ProgramData, or Users\Public, indicating potential abuse of a legitimate application.
Cortex XDR
