Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

WarzoneRat, AveMaria

WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

Warzone RAT Payload

Blocklisted process makes network request

Executes dropped EXE

Sets DLL path for service in the registry