Operation DragonReturn: DcRAT Injection into svchost.exe via Mixed Reality.exe
Detects reflective process injection attempts where a suspicious executable, masquerading as 'Mixed Reality.exe' in a Windows Media Player directory, attempts to inject code into the svchost.exe system process using cross-process memory operations like CreateRemoteThread.
Microsoft Sentinel (KQL)
