AgtaBackup service or Credential Guard.exe spawning shell or PowerShell
Detects the AgtaBackup implant executing command shells or PowerShell sessions where the parent process is either a masqueraded Credential Guard.exe outside standard paths or associated with AgtaBackup service paths/command lines.
Microsoft Sentinel (KQL)
