All Detections

Possible Process Hollowing Image Loading

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 20251011

Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz

Sigma