SparroWocky ProcAuditManager malicious service persistence

Arnold Chan@slaz

•updated 22 days ago•0•0•1

Detects the creation or modification of a Windows service named 'ProcAuditManager' via registry keys or command-line utilities. This pattern is indicative of potential persistence mechanisms or service manipulation for malicious purposes.