Sdclt Child Processes for UAC Bypass
This rule detects when 'sdclt.exe' (System Data Collector) spawns any child processes. This behavior is often associated with User Account Control (UAC) bypass techniques, where sdclt.exe is leveraged to execute arbitrary code with elevated privileges without triggering a UAC prompt. The rule is a general indicator of such activity.
Sigma
