Process Name Masquerading of Core Windows System Binaries
Detects instances of common, sensitive Windows system binaries (svchost.exe, lsass.exe, sms.exe, csrss.exe) being executed by parent processes other than the legitimate system processes (services.exe, smss.exe, csrss.exe, winlogon.exe), indicating potential process masquerading or path spoofing.
Microsoft Sentinel (KQL)
