Process Injection into svchost/explorer/lsass via Remote Thread Creation
Detects instances where critical Windows host processes (svchost.exe, explorer.exe, or lsass.exe) spawn a new process, which is a common behavioral indicator of process injection or post-exploitation activity. The rule excludes common, legitimate system-level causality chains.
Cortex XDR
