Win32k WM_COPYDATA Suspicious Cross-Process Message Injection to Sensitive Targets
Detects suspicious handle requests (Sysmon Event ID 8: CreateRemoteThread, Event ID 10: ProcessAccess) targeting critical Windows processes lsass.exe, svchost.exe, and explorer.exe from unauthorized source processes. The rule specifically looks for suspicious access rights and filters out known legitimate system processes.
Splunk (SPL)
