Remote Support Process Performs Process Hollowing Preparation
Detects a remote support or loader process spawning a suspended process or invoking commands associated with RunPE and hollowing. This rule specifically looks for processes initiated by 'ScreenConnect', 'SimpleRunPE', or 'ClientService' that include command-line arguments indicative of process hollowing or injection techniques such as 'CREATE_SUSPENDED', 'NtUnmapViewOfSection', 'RunPE', 'hollow', or 'process injection'.
Microsoft Sentinel (KQL)
