LokiBot Reflective Injection into aspnet_compiler.exe via Process Hollowing
Detects the LokiBot malware spawning aspnet_compiler.exe to perform process hollowing. The rule identifies this activity by monitoring process creation events and filtering out legitimate .NET build processes, targeting the specific behavior of using aspnet_compiler.exe as a host for reflective code injection.
Sigma
