Suspicious Windows Process Indicators

nomit vyas@xoxo

•updated Feb 19, 2026•0•37

Detects suspicious Windows process execution that may indicate post-exploitation activity, lateral movement, or privilege escalation. This is a generic detection rule for uncommon or high-risk commands and tools.