Suspicious Process Spawned by services.exe
Detects when the Windows Service Control Manager (services.exe) spawns a suspicious child process. This can indicate an attacker has configured a service's recovery options to execute a malicious command or script upon service failure.
Microsoft Sentinel (KQL)
