Havoc Demon Shellcode Injection into Explorer.exe via Remote Thread
Detects evidence of the Havoc Demon agent performing process injection into explorer.exe. The detection looks for a sequence of events: first, a suspicious process (excluding explorer.exe and userinit.exe) opening a handle to explorer.exe, followed by a cross-process thread creation event originating from the same source process against the same target.
YARA-L
