Elevated System Shell Spawned

SigmaHQ Detections@sigmaHQ

•updated Apr 7, 2025•0•18

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. This rule helps identify potential suspicious processes that have escalated privileges.