Abyssos correlated multi-thread host-state polling from unsigned parent process
Correlates at least 3 of 4 distinct Abyssos background polling threads (clipboard, process list, network connections, screen capture) launched by the same unsigned/unknown-signature parent process within the same 5-minute window.
Microsoft Sentinel (KQL)
