Suspicious Child Process Spawning from Interpreters
Detects the spawning of core Windows system processes (explorer.exe, svchost.exe, lsass.exe, winlogon.exe) by common script interpreters (powershell.exe, cmd.exe, wscript.exe). This pattern is often indicative of malicious activity, such as process hollowing, privilege escalation, or persistence mechanisms where an adversary abuses these interpreters to initiate or inject into critical system processes.
Microsoft Sentinel (KQL)
