UNC3569 sgbiz: Handler Abuse with Argument Injection + Post-Launch Correlation

Arnold Chan@slaz

•updated 27 days ago•2•0•4

Detects anomalous command-line arguments and process injection behaviors associated with the Sogou IME protocol handler (biz_helper.exe). The rule monitors for malicious argument injection (e.g., embedded scripts, URLs pointing to non-Sogou domains) and correlates these events with suspicious child processes or network activity, consistent with techniques observed in the GRAYRABBIT / UNC3569 threat activity.