Process hollowing into RegAsm.exe spawned by PowerShell for AsyncRAT execution
Detects instances where PowerShell.exe spawns Regasm.exe. Regasm.exe is a known Windows utility that can be abused to proxy execution of arbitrary code, a technique often used by adversaries to bypass application controls or execute malicious payloads.
Cortex XDR
