process name spoofing artifact detector — free browser tool | fatcousin

home

drop 4688 or sysmon evtx csv · detect processes using legitimate windows binary names from wrong paths · identify masquerading attacks · surface svchost lsass and other system binary impersonation · runs locally

input

drop anti-forensics export

csv · json · jsonl · multiple files · local only

Select file

drop 4688 or sysmon evtx csv · local only

limits

heuristic screener · vendor schema varies · not definitive proof

status

>ready