Process Injection Telemetry Discovery
Identifies available cross-process memory and thread manipulation telemetry events in DeviceEvents, tracking actions such as remote thread creation, virtual memory allocation, and process hollowing indicators before constructing process injection correlations.
Microsoft Sentinel (KQL)

