VirusTotal Relationship: File Executes File
This rule detects when a process executes another process, and both the principal (parent) process's file hash and the target (child) process's file hash have known 'EXECUTES' relationships in VirusTotal. This indicates that VirusTotal has previously observed the parent process executing the child process, which could be a sign of malicious activity if the hashes are associated with known threats.
YARA-L
