Payouts King: Process Injection into svchost/explorer via Cross-Process APIs
Detects cross-process memory or thread injection activity where an untrusted or non-system process attempts to inject code into critical system processes such as svchost.exe, explorer.exe, or lsass.exe. This excludes legitimate system process-to-system process interactions to reduce noise.
CQL
