Unusual Parent Process For Cmd.EXE
This rule detects instances where 'cmd.exe' is spawned by a parent process that is considered unusual or suspicious. The rule specifically lists a set of parent processes that are generally not expected to launch 'cmd.exe' in a typical operating environment. This could indicate malicious activity such as an attacker attempting to execute commands via a compromised legitimate process or a process that has been hijacked.
Sigma
