Brute Ratel C4 PPID Spoofing Explorer
Detects notepad.exe spawned by explorer.exe that immediately initiates network connections, which is a known behavior of Brute Ratel C4 (BRc4) when performing Parent PID Spoofing.
Microsoft Sentinel (KQL)
Detects notepad.exe spawned by explorer.exe that immediately initiates network connections, which is a known behavior of Brute Ratel C4 (BRc4) when performing Parent PID Spoofing.
Already have an account?