Suspicious SysAidServer Child Process
This rule detects the creation of child processes by SysAidServer, specifically when the parent process is either 'java.exe' or 'javaw.exe' and its command line contains 'SysAidServer'. This activity has been observed in intrusions attributed to the MERCURY (MuddyWater) threat actor, suggesting potential exploitation or unauthorized execution within the SysAid environment.
Sigma
