Exploitarium PoC - calc.exe Spawned by Anomalous Non-Standard Parent Process
Detects instances where the Windows calculator application (calc.exe) is launched as a child process of suspicious parent applications associated with known proof-of-concept exploits. This detection aims to identify successful exploitation events where calc.exe is used as a payload to demonstrate arbitrary code execution.
Microsoft Sentinel (KQL)
