C2 Egress to ACRStealer Infrastructure from Hollowed/Injected Process Context

Duo Tech@duotech

•updated Aug 17, 2026•0•0•8

Detects outbound C2 connections to known ACRStealer infrastructure IPs specifically from a process already flagged as hollowed/injected (wab.exe, MSBuild.exe, dllhost.exe) via a companion flowbit, rather than flagging all egress from these processes.