Process Hollowing into Trusted/Signed Process Image (Stealth Falcon CURP/DlrtyGames)
Detects instances of process hollowing involving specific security product images (Qihoo 360) or identified binaries (MegArray.exe, Crisp.exe) as indicated by process tampering logs. This behavior is associated with advanced threat activity potentially attempting to masquerade malicious execution under trusted or known-path binary contexts.
Cortex XDR
