Uncommon Sigverif.EXE Child Process
This rule detects when 'sigverif.exe' spawns child processes that are not 'WerFault.exe'. 'sigverif.exe' is a legitimate Windows binary used for verifying file signatures. However, it can be abused as a Living Off the Land Binary (LOLBIN) to proxy execution of other malicious processes, thereby bypassing application whitelisting or other security controls. The rule specifically filters out 'WerFault.exe' as a common and legitimate child process of 'sigverif.exe' to reduce false positives.
Sigma
