Abyssos-style reverse-shell cmd.exe spawned by externally-connected parent process
Detects a cmd.exe process spawned as a direct child of a process that just established an outbound connection to a public IP, excluding common RMM/remote-support tools — consistent with Abyssos's C2CMD interactive reverse-shell capability.
Microsoft Sentinel (KQL)
