Process spawned via remote thread
Identifies the creation of a process with the parent call stack not revealing normal API functions for process creation. This may be a sign of process injection.
- Plataforma: Windows
- Severidad: High
- Táctica MITRE: Evasión de defensas
- Técnicas MITRE: T1055