High Number of Command Shell Process Spawning in a Short Timeframe
Detects a high frequency of 'shell' processes spawned by the same parent process, a behavior indicative of the LunoBotnet's watchdog-based self-healing and persistence mechanism. The parent process often masquerades as a kernel worker.
YARA-L
