• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    AutoGen Studio Suspicious Child Process

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Ethan Andrews@eandrews
    •updated Jun 18, 2026•4•0•17

    Detects common shell and utility processes spawning as children of the AutoGen Studio process, indicating potential remote code execution via the AutoJack exploit chain.

    Microsoft Sentinel (KQL)

    Tags

    TA0002 - ExecutionT1059 - Command and Scripting InterpreterT1203 - Exploitation for Client ExecutionT1059.001 - PowerShellT1059.003 - Windows Command ShellT1059.004 - Unix ShellS0106 - cmdS0160 - certutilT1218.005 - MshtaT1218.011 - Rundll32T1218.010 - Regsvr32TA0005 - Defense EvasionProcess CreationCommand ExecutionScript ExecutionWindowskql

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?