Suspicious Child Process Created as System by Service Account
This rule detects the creation of a child process with SYSTEM privileges where the parent process was running under a LOCAL SERVICE or NETWORK SERVICE account. This behavior is often indicative of privilege escalation techniques such as Rotten Potato or RogueWinRM, which exploit vulnerabilities to elevate privileges from service accounts to SYSTEM.
Sigma
