Suspicious Child Process Of SQL Server
Detects suspicious child processes spawned by the SQL Server process (sqlservr.exe). This activity is highly indicative of successful exploitation, such as Remote Code Execution (RCE) or SQL Injection, where an attacker leverages the SQL Server to execute arbitrary commands on the underlying operating system. The rule specifically looks for common system utilities and scripting interpreters that are often used by attackers for reconnaissance, persistence, or further compromise.
Sigma
