Process Monitor Driver Creation By Non-Sysinternals Binary

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2026•0•0•1

Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.