Potentially Suspicious Child Process of KeyScrambler.exe
This rule detects the creation of suspicious child processes by 'KeyScrambler.exe'. KeyScrambler is legitimate software designed to encrypt keystrokes, but if compromised, it could be used to launch malicious binaries. The rule specifically looks for 'KeyScrambler.exe' as a parent process launching common Windows utilities often abused by attackers, such as 'cmd.exe', 'cscript.exe', 'mshta.exe', 'powershell.exe', 'pwsh.exe', 'regsvr32.exe', 'rundll32.exe', and 'wscript.exe'. This behavior could indicate an attacker leveraging a compromised KeyScrambler process for execution, defense evasion, or privilege escalation.
Sigma
