Potential PPL Abuse via ClipUp.exe to Disable Defender
Detects the execution of "ClipUp.exe" with specific command-line parameters used to abuse Protected Process Light (PPL) to tamper with the Microsoft Defender process ("MsMpEng.exe"). This technique was observed in the RONINGLOADER campaign.
Sigma
