OceanLotus FireAnt MetaKit Supply-Chain - Metakit.exe Spawning setup.exe
Detects instances where the FireAnt MetaKit investment client (Metakit.exe) spawns 'setup.exe' as a child process. This pattern is indicative of a supply-chain attack involving the compromise of the FireAnt MetaKit update server, where the application is used to trigger the execution of a malicious downloader or installer.
Sigma
