CVE-2019-1068 SQL Server RCE: sqlservr.exe spawning suspicious child
Detects instances where the SQL Server process (sqlservr.exe) initiates a child process that is a known command-line tool, script interpreter, or utility often used in living-off-the-land attacks, or when a child process is spawned from suspicious directory paths such as AppData, Temp, or Windows\Temp.
Microsoft Sentinel (KQL)
