examples:

• description: "Execute AvastSvc.exe and observe the unusual behavior" command: "AvastSvc.exe"

AvastSvc.exe

Avast scans your network on the sly.

During scans, AvastSvc.exe will attempt to connect to neighboring IP addresses over SSH. Users such as FakeDomain\FakeUser will be used, as well as blank users/null SIDs.

Contributed by mttaggart