StopAndProtect unsigned Loader.exe spawning unsigned network-fetching child
Detects an unsigned Loader.exe spawning a second unsigned executable that performs immediate outbound network fetch, matching the StopAndProtect loader/downloader chain with sandbox-evasion checks.
Microsoft Sentinel (KQL)
