ResiLoader Process Hollowing into ServiceModelReg.exe
This rule detects potentially malicious activity involving the ServiceModelReg.exe process, a known vector for ResiLoader process hollowing. It monitors for cross-process injection (e.g., process hollowing) and process creation events where ServiceModelReg.exe is spawned by suspicious parent processes (such as scripting engines) or originates from an unexpected location.
SentinelOne
