Suspicious Child Process of AspNetCompiler
Detects suspicious child processes spawned by "aspnet_compiler.exe". This often indicates an adversary is abusing the legitimate `aspnet_compiler.exe` utility for proxy execution, potentially to bypass application controls or execute malicious code from unexpected locations. The rule specifically looks for common executables like `calc.exe` or `notepad.exe` and processes launched from suspicious temporary or user-specific directories.
Sigma
