02/Process checks
What it looks for.
Each process is checked every 3 seconds. Findings are hints, not verdicts: every rule has innocent explanations, so treat a flag as a reason to look closer.
A Windows process name (svchost, lsass…) running from outside System32
High
A name one character off a Windows process, like scvhost.exe
High
Invalid or tampered digital signature
High
Unsigned and running from Temp, Public, the Recycle Bin or the root of AppData / ProgramData
High
Encoded PowerShell, download-and-run commands, misuse of mshta, certutil, regsvr32 or rundll32
High
An Office app starting cmd, PowerShell or a script host
High
Running from a suspicious folder (one level lower if signed)
Medium
Hidden-window PowerShell, Base64 decoding, a browser starting a script host
Medium
Unsigned program in a normal location; execution-policy bypass
Low
Signatures are verified with Windows' own WinVerifyTrust. Revocation is not checked, so no network access is needed.