Millenium RAT spawns PowerShell or CMD from masquerading RAT process
Detects the execution of command-line shells (powershell.exe or cmd.exe) spawned by processes that are typically associated with system services or security products (e.g., svchost.exe, MsEdgeUpdate.exe), where the parent process is not located in the standard Windows System32 directory. This pattern often indicates attempts to bypass security controls or masquerading by malicious actors to achieve code execution.
Microsoft Sentinel (KQL)
