Cmd.exe Child Process of Fake NVIDIA Container Runtime Monitor

Duo Tech@duotech

•updated Jul 17, 2026•0•0•1

Detects instances where the command shell 'cmd.exe' is launched as a child process of 'nvidia-sysruntime.exe'. This behavior is anomalous as 'nvidia-sysruntime.exe' typically does not spawn command interpreters, suggesting potential masquerading or process hollowing where an attacker is using a disguised malicious binary to execute shell commands.