AdaptixC2 AdgNsy.exe Process Injection into WAB.exe via WmiPrvSE
This rule detects suspicious process access or remote thread creation events where AdgNsy.exe interacts with WAB.exe (Windows Address Book). Such activity is indicative of potential process injection or unauthorized memory access to steal contact data or manipulate process memory.
Splunk (SPL)
