Suspicious Process Spawned By SQL Server
Detects a suspicious process or Living-Off-the-Land Binary (LOLBin) being launched by a Microsoft SQL Server process (sqlservr.exe). This behavior is often indicative of post-exploitation activity after a database server has been compromised.
YARA-L
