Process hollowing via suspended explorer.exe child process
This rule detects suspicious process injection activity directed at explorer.exe. It looks for cases where explorer.exe is initiated by a non-standard parent process and performs remote thread creation, thread context manipulation, or process image mapping, which are common techniques used by malware to hide execution within a legitimate system process.
Microsoft Sentinel (KQL)
