Masquerading symantec.exe executing from non-Symantec install path

Duo Tech@duotech

•updated Jul 13, 2026•3•0•5

Detects instances where a process named 'symantec.exe' is executed from a path other than the standard Symantec installation directories. This behavior is indicative of an attempt to disguise a malicious executable as a legitimate Symantec software component.