Blind Eagle JC-46 Process Injection into Rare Signed Microsoft Binaries
Detects Blind Eagle JC-46 AsyncRAT process-injection/hollowing pivot: wscript.exe, cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries (RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID spoofing where these binaries appear to be spawned directly by explorer.exe.
Microsoft Sentinel (KQL)
