Suspicious CustomShellHost Execution
Detects the execution of 'CustomShellHost.exe' where its child process is not 'C:\Windows\explorer.exe'. This behavior can indicate an attempt to use CustomShellHost for proxy execution, potentially bypassing security controls or for defense evasion.
Sigma
