Operation Turb00: Suspended-Process Hollowing — Temp Image Loads Before ntdll.dll
This rule detects a sequence of events where specific potentially malicious parent processes spawn child processes (WizardDa42.exe or AlphVector.exe spawning NeuroManag.exe or VirtualAr.exe). Following this, the child process is observed loading a .tmp file from the AppData Local Temp directory, followed shortly by the loading of ntdll.dll. This pattern is often indicative of process injection or hollowed process behavior where a payload is dropped as a temporary file and subsequently executed or reflected in memory.
CQL
