cmd.exe Spawned by Xctdoor-Injected System Process (Interactive Shell Execution)
Detects cmd.exe spawned as a child of a Windows system process known to be an Xctdoor injection target, consistent with the backdoor's interactive shell and multi-command execution capability run via 'cmd /c' from inside the injected process.
Sigma
