Bad Opsec Defaults Sacrificial Processes With Improper Arguments (a7c3d773-caef-227e-a7e7-c2f13c622329)
Detects attackers using tooling with bad opsec defaults. E.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run. One trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.