ViPNet Itcsrvup64.exe remote thread injection into svchost.exe
Detects process injection where itcsrvup64.exe (the ViPNet Update System component, sideloaded per HelloNet campaign) creates a remote thread in svchost.exe using NtWriteVirtualMemory/NtCreateThreadEx, targeting the netsvcs service host process.
Microsoft Sentinel (KQL)
