Process hollowing of suspended explorer.exe (ZigCryptoStealer)

Ibrahim Saud@tektrix

•updated 18 days ago•2•0•3

Detects instances of explorer.exe being launched by a parent process other than expected system processes (explorer.exe, userinit.exe, or winlogon.exe). This behavior is highly irregular for Windows desktop environments and may indicate process injection or malicious process masquerading.