Suspicious Windows Terminal Child Process Execution
Detects suspicious child processes spawned by Windows Terminal (WindowsTerminal.exe or wt.exe). This rule identifies the execution of common Living Off The Land Binaries (LOLBins) like rundll32.exe, regsvr32.exe, certutil.exe, cscript.exe, wscript.exe, and csc.exe, as well as processes launched from suspicious user-controlled directories (e.g., Downloads, Desktop, Temp folders). Additionally, it flags command lines containing keywords often associated with malicious activity, such as PowerShell Invoke- and DownloadString, or common command shell execution parameters. This activity could indicate an adversary establishing persistence or executing malicious code via Windows Terminal.
Sigma
