Spool process spawned a CMD shell (PrintNightmare vulnerability - CVE-2021-36958)

Detects scenarios where an attacker exploits the PrintNightmare vulnerability and obtained a CMD shell.