Cobalt Strike Beacon Process Injection into svchost.exe or explorer.exe
Detects instances where suspicious, non-Windows-standard processes (residing outside of System32 or SysWOW64) spawn or interact with critical system processes like svchost.exe or explorer.exe. This activity is indicative of process injection techniques used by malware loaders, such as SharkLoader, to execute malicious code within the context of trusted system processes to maintain persistence or elevate privileges.
Cortex XDR
