Unusual Child Process of dns.exe

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•20

Detects an unexpected process spawning from dns.exe, which may indicate activity related to remote code execution or other forms of exploitation, specifically referencing CVE-2020-1350 (SigRed). The rule filters out legitimate child processes like conhost.exe.