DcRAT Process Injection into svchost.exe via Suspicious GrantedAccess
Detects attempts by potentially malicious processes to inject code into svchost.exe. The rule monitors Sysmon Event ID 10 (ProcessAccess) for specific granted access masks (0x1fffff, 0x1f0fff, 0x143a) commonly used for virtual memory manipulation, while excluding trusted Windows system processes.
Sigma
