Unusual Child Process Spawned by .NET Build Utility
Detects trusted .NET tooling launching shells, scripting engines, or administrative utilities that are not typically associated with legitimate compilation workflows, potentially indicating malicious execution or post-exploitation.
Microsoft Sentinel (KQL)
