Anomalous Outbound Network Connection from Xctdoor-Injected System Process
Detects outbound network connections directly initiated by Windows system processes known to be Xctdoor injection targets (explorer.exe, ApplicationFrameHost.exe, RuntimeBroker.exe, sihost.exe, taskhostw.exe). Serves as the practical host-log proxy for screen capture, keylogging, clipboard theft, and reconnaissance-data exfiltration -- backdoor capabilities exercised entirely via in-process API calls with no distinct artifact of their own.
Sigma
