ImageMagick GhostScript Delegate Path Hijack - gswin64c.exe from Non-Standard Path
Detects instances where ImageMagick (magick.exe, convert.exe, or mogrify.exe) launches a Ghostscript executable (gswin64c.exe, gswin32c.exe, gs.exe, or gsx.exe) from a file path outside of the standard installation directories. This behavior is indicative of a Ghostscript delegate path hijacking exploit, which can be leveraged to achieve arbitrary code execution when processing malicious PostScript (PS/EPS) or PDF files.
Microsoft Sentinel (KQL)
