Suspicious grpconv.exe Execution from Uncommon Directory
Detects the execution of the Windows utility 'grpconv.exe' when it is spawned by a parent process located in a temporary or otherwise uncommon directory. This is an unusual parent-child relationship and is indicative of techniques like process hollowing used by malware such as the Evelyn Stealer's second-stage injector.
Sigma
