APT37 Process Doppelgänging Detection

Tim Peck@timpeck

•updated Sep 8, 2025•1•1•71

Detects a sequence of events indicative of Process Doppelgänging, a technique used by APT37. This rule identifies a process creating a legitimate Windows utility and then immediately injecting code into it, which is characteristic of creating a process in a suspended state for injection.