Suspicious Child Process from ManageEngine

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•2

This rule detects the creation of suspicious child processes (PowerShell, Command Prompt, WScript, CScript, or Rundll32) originating from ManageEngine applications. This behavior could indicate an adversary leveraging a compromised ManageEngine service to execute malicious scripts or commands, potentially as part of a phishing attack or other compromise.