Remote thread injection into rundll32/svchost/explorer from Office or browser

ills3c Intel&Coffee@Ills3C

•updated today•1•0•1

Detects remote thread creation (CreateRemoteThreadApiCall) where the source process is an Office application, browser, or script host, and the target process is a critical system binary such as rundll32.exe, svchost.exe, or explorer.exe.