Uncommon Child Processes Of SndVol.exe
This rule detects the creation of unusual child processes originating from 'SndVol.exe', which is the legitimate Windows volume mixer. The rule specifically filters out 'rundll32.exe' when it's used with 'shell32.dll,Control_RunDLL', as this is a common and legitimate behavior. Any other child processes spawned by 'SndVol.exe' are considered suspicious and could indicate an attempt to hide malicious activity behind a legitimate process.
Sigma
