Suspicious PowerShell Parent Process
Detects the execution of PowerShell where the parent process is suspicious or uncommon. This rule specifically looks for PowerShell being spawned by processes like web servers (tomcat, httpd, nginx, w3wp), database servers (sqlagent, sqlserver, sqlservr), browsers (chrome, firefox, iexplore, microsoftedge, safari, vivaldi, browser.exe, amigo.exe), or other processes not typically expected to launch PowerShell, such as mshta.exe, regsvr32.exe, rundll32.exe, services.exe, jbosssvc.exe, and php-cgi.exe. This pattern can indicate various forms of compromise, including web shell execution, SQL injection leading to command execution, or malicious scripts launched by compromised applications or user interaction.
Sigma
