HackTool - Potential CobaltStrike Process Injection — Detection Rule

Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons

Read the full analysis on IntelFusions