Wlrmdr.exe Uncommon Argument or Child Process
Detects the execution of "Wlrmdr.exe" with the "-u" command line flag, which allows anything passed to it to be an argument of the ShellExecute API, potentially enabling an attacker to execute arbitrary binaries. This detection also identifies uncommon child processes spawned from "Wlrmdr.exe" as a supplementary measure for environments with "ParentImage" telemetry.
Sigma
