Process Hollowing Into Signed Binary from Suspicious Staging Path
This rule detects scenarios where an unsigned process, originating from typical staging areas (e.g., Temp, AppData, ProgramData), performs cross-process injection (e.g., process hollowing) into a signed third-party binary. This behavior is indicative of malware loaders attempting to masquerade their execution by hiding within the context of legitimate, signed software.
SentinelOne
