Eolh Rules

Eolh has detection rule engine and a few default rules.

A new PE file is created in a container. This is normal behavior in the early stages of container creation.

An attacker can tamper with parent process and hide the true parent-child relationship to evade detection.

A crypto miner using the Stratum protocol is found.

The Tor Executable is found.