INISAFECrossWebEXSvc.exe spawning fsquirt.exe (Lazarus FlashHole)
Detects the Inisafe CrossWeb EX service (INISAFECrossWebEXSvc.exe) launching fsquirt.exe, which can indicate potential abuse of built-in Windows utilities following a malicious lure or script execution.
Microsoft Sentinel (KQL)
