Taskmgr Executed as LOCAL_SYSTEM
Detects the creation of taskmgr.exe process running under the LOCAL_SYSTEM account. This is an unusual and potentially malicious activity, as task manager typically runs under the user's context. This could indicate an attempt to elevate privileges or execute code with SYSTEM privileges.
Sigma
