Matanbuchus - Process Hollowing into Legitimate Binaries (T1055.012)
Correlates the executing Matanbuchus DLL performing process hollowing or injection into legitimate Windows binaries (e.g., svchost.exe, dllhost.exe) to execute AstarionRAT. This rule specifically looks for 'rundll32.exe' as the initiating process, targeting 'svchost.exe', 'dllhost.exe', or 'WerFault.exe' as the child process, and where the command line of the child process does not contain typical command-line arguments (hyphens or slashes), which can be indicative of process hollowing where the legitimate binary is started without its usual parameters before being injected.
Microsoft Sentinel (KQL)
