Suspicious Child Process Spawned by sqlservr.exe Indicating Possible RCE
This rule detects instances where the SQL Server process (sqlservr.exe) spawns common command-line interpreters or administrative utilities that are frequently abused by attackers for post-exploitation activities, such as command execution, enumeration, or evasion. This behavior often indicates an attempt to leverage SQL Server's capabilities to execute operating system commands, such as via the xp_cmdshell procedure.
CQL
