Suspicious Child Process Execution from Known Parent Processes (CoolClient Backdoor)

Kaung Khant Ko@kaungkhantko

•updated Jan 27, 2026•29•1•215

This rule detects the execution of specific child processes (write.exe, cmd.exe) when initiated by a predefined list of parent processes (Sang.exe, googleupdate.exe, vlc.exe, clreg.exe, Nlasvr.exe, qutppy.exe) and when the parent process command line contains certain keywords ('install', 'work', 'passuac'). This pattern can indicate suspicious activity, potentially related to malware installation, persistence, or command and control.