Uncommon Child Process of Setres.EXE
This rule detects the creation of a child process named 'choice' by 'setres.exe', which is an uncommon and potentially malicious behavior. Setres.exe is a legitimate Windows server tool used to set screen resolution, but it can be abused to launch arbitrary executables, especially those with 'choice' in their name, from the current execution path. The rule specifically filters out legitimate instances of 'choice.exe' located in 'C:\Windows\System32\' or 'C:\Windows\SysWOW64\'.
Sigma
