CornFlake/ChocoShell Remote Shell Spawned by Malicious svchost32.exe (Non-System32) with -NoP Flag and Network Callback
Detects a process named svchost32.exe running from a non-System32 path that spawns cmd.exe or powershell.exe with a -NoProfile/-NoP flag and subsequently makes an outbound network connection, consistent with CornFlake/ChocoShell remote shell behavior.
Cortex XDR
