Elevated System Shell Spawned From Uncommon Parent Location

SigmaHQ Detections@sigmaHQ

•updated Apr 7, 2025•0•14

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from an uncommon parent location. This behavior can indicate privilege escalation or defense evasion by an attacker.