ARTEX application process spawning root sh -c shell child
Detects a root shell (sh, dash, or bash) spawned as a child process of an ARTEX application process, which is consistent with exploitation or backdoored login handlers passing command execution remainders to a shell.
Microsoft Sentinel (KQL)
