MMC Child Process Anomaly Detection
This rule detects anomalous child processes spawned by mmc.exe. It specifically looks for processes initiated by mmc.exe that are not located in expected system directories or common program file paths, indicating potential abuse of the Microsoft Management Console for malicious execution.
Microsoft Sentinel (KQL)
