Uncommon Userinit Child Process
Detects uncommon child processes spawned by "userinit.exe". Legitimate child processes of userinit.exe typically include explorer.exe, logon scripts (like netlogon.bat, UsrLogon.cmd), PowerShell.exe on Windows Core, and specific Citrix or proquota.exe processes. The rule aims to identify suspicious or malicious executables launched by userinit.exe, which could indicate persistence mechanisms or privilege escalation attempts.
Sigma
