ImageMagick gswin64c.exe delegate hijack spawned from non-standard path
Detects the execution of Ghostscript (gswin64c.exe, gswin32c.exe, or gs) spawned by ImageMagick binaries (magick.exe, convert.exe, or identify.exe) where the Ghostscript binary is located outside of standard program installation directories. This behavior is indicative of potential delegate hijacking or exploitation attempts where an adversary provides a malicious Ghostscript binary to ImageMagick.
Splunk (SPL)
