Velociraptor.exe Running as SYSTEM from Non-Service Parent Process
Detects execution of the Velociraptor binary (velociraptor.exe) running with SYSTEM privileges while not being launched by the expected services.exe process. This often indicates potential unauthorized use or manual deployment of the tool, bypassing standard management procedures.
Microsoft Sentinel (KQL)
