SNOWLIGHT Security Tool Process Enumeration Discovery
This rule detects the execution of common security analysis, reverse engineering, and debugging tools such as Process Hacker, IDA Pro, Wireshark, and various debuggers. While these tools are legitimate for development and troubleshooting, their presence in unexpected contexts may indicate reconnaissance or analysis activities by an adversary.
Cortex XDR
