StealC/Amadey Process Injection into svchost.exe or explorer.exe

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects behavior indicative of StealC or Amadey malware loading and executing in-memory by injecting code into trusted Windows system processes such as svchost.exe or explorer.exe. The rule correlates a process launch from suspicious locations like Temp or AppData with subsequent process access events targeting these host processes, typically signaling process injection for evasion.