HardBreacher exploitation of Kaspersky avp.exe for SYSTEM privilege escalation
Detects instances where the Kaspersky antivirus process (avp.exe) spawns potentially malicious or administrative binaries like cmd.exe, powershell.exe, or specific artifacts related to 'HardBreacher'. This behavior is highly irregular as antivirus software typically does not initiate these types of processes under high-privilege tokens.
Microsoft Sentinel (KQL)
