ImageMagick Ghostscript Delegate gswin64c.exe PATH Hijack
Detects instances of ImageMagick utilities (magick.exe, convert.exe, mogrify.exe, identify.exe) spawning Ghostscript executables (gswin64c.exe, gs.exe, gswin32c.exe) from non-standard file paths or using specific command-line arguments often associated with exploitation attempts (such as -dSAFER or -dQUIET). This activity is consistent with attempts to exploit vulnerabilities like CVE-2023-34151 or similar ImageTragick-style attacks where ImageMagick is abused to execute arbitrary code via Ghostscript delegates.
Cortex XDR
