MMC Spawning Windows Shell
Detects instances where the Microsoft Management Console (mmc.exe) launches suspicious child processes often associated with adversary activity, such as command shells, scripting engines, or system management utilities. This behavior is frequently used to proxy execution or perform unauthorized system modifications, with the exception of the standard Task Scheduler snap-in.
Cortex XDR
