Using SettingSyncHost.exe as LOLBin (b2ddd389-f676-4ac4-845a-e00781a48e5f)

Detects using SettingSyncHost.exe to run hijacked binary

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Path Interception by Search Order Hijacking - T1574.008 (58af3705-8740-4c68-9329-ec015a7013c2)	Attack Pattern	Using SettingSyncHost.exe as LOLBin (b2ddd389-f676-4ac4-845a-e00781a48e5f)	Sigma-Rules	1
Path Interception by Search Order Hijacking - T1574.008 (58af3705-8740-4c68-9329-ec015a7013c2)	Attack Pattern	Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6)	Attack Pattern	2