Suspicious Userinit Child Process
This rule detects the creation of a suspicious child process by 'userinit.exe'. Userinit.exe is a legitimate Windows process responsible for initializing the user environment during logon. Malicious actors may attempt to leverage or compromise this process to execute arbitrary code, establish persistence, or elevate privileges. The rule specifically filters out legitimate child processes like 'explorer.exe' and processes related to netlogon to reduce false positives.
Sigma
