VSHELL RAT Process Discovery via CreateToolhelp32Snapshot or EnumProcesses
This rule detects potentially malicious process discovery or memory access behavior. It triggers when processes perform frequent calls to common process enumeration APIs (e.g., CreateToolhelp32Snapshot, NtQuerySystemInformation) or when any process gains access to the Windows Update service (wusvc.exe), which is often used as a target for process injection or hollowing.
Splunk (SPL)
