RunPE process hollowing via full suspended-inject-resume sequence on unsigned target
Detects the full RunPE process-hollowing sequence (suspended process creation, WriteProcessMemory, SetThreadContext, ResumeThread) executed within 30 seconds against an unsigned, non-OS target process.
Microsoft Sentinel (KQL)
