AdaptixC2 Process Hollowing via WmiPrvSE.exe Spawning or Injecting WAB.exe
Detects suspicious activity associated with the AdaptixC2 framework, specifically process hollowing or shellcode injection where WmiPrvSE.exe spawns or creates remote threads in WAB.exe (Windows Address Book). This pattern has been observed in Akira ransomware intrusions.
Sigma
