Suspicious Provlaunch.EXE Child Process for Proxy Execution
Detects suspicious child processes spawned by "provlaunch.exe". This behavior indicates potential abuse of "provlaunch.exe" for proxy execution, where a legitimate signed binary is used to execute other malicious or suspicious binaries, often for defense evasion. The rule specifically looks for common Windows utilities or executables in suspicious temporary or user-writable directories being launched as children.
Sigma
