Suspicious Child Process from SQL Server

nomit vyas@xoxo

•updated Feb 19, 2026•0•31

Detects suspicious child processes spawned by sqlservr.exe, potentially associated with Trigona threat actor activity.