Anomalous native-API or command-shell execution requiring corroborating alert
Detects cmd.exe /c spawned by an unusual parent process combined with native-API execution patterns outside normal application behavior, excluding common benign parent-child chains, and requires co-occurrence with at least one other flagged detection before surfacing given its low specificity.
Microsoft Sentinel (KQL)
