Suspicious Process Execution with Sysmon as Parent
Detects suspicious process executions where Sysmon itself is the parent of a newly created process. This behavior can indicate an exploitation attempt, such as the one described in CVE-2022-41120, where an attacker might leverage a vulnerability in Sysmon to execute arbitrary code with elevated privileges. The rule filters out legitimate Sysmon processes and known system processes that might legitimately be children of Sysmon.
Sigma
