C2Looper Shellcode Injection into winspool.drv via Remote Thread (Excludes Legit Print Processes)
Detects C2Looper injecting shellcode into the legitimate winspool.drv module via a remote thread, excluding legitimate print subsystem processes.
Microsoft Sentinel (KQL)
