PavokwiLoader Injection into smartscreen.exe or Browser via Nt/Zw APIs
Detects PavokwiLoader behavior where a potentially malicious process spawns a browser or system process (e.g., smartscreen.exe) in a suspended state, followed by cross-process memory allocation and writing, and subsequent thread hijacking or execution resumption, indicating a process hollowing injection technique.
Microsoft Sentinel (KQL)
