Windows Shell/Scripting Processes Spawning Suspicious Programs

SigmaHQ Detections@sigmaHQ

•updated May 23, 2023•0•0•1

Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.