Suspicious Process Parents
This rule detects suspicious child processes spawned by parent processes that typically should not have any children, or should only have a very limited set of known child processes. The rule specifically looks for child processes of applications like Minesweeper, Winver, Bitsadmin, Csrss, Certutil, Eventvwr, Calc, and Notepad, while filtering out common legitimate child processes for some of these parents (e.g., WerFault.exe, conhost.exe). This behavior can indicate defense evasion or execution of malicious code from an unexpected parent.
Sigma
