CAR-2013-02-003 - Process Spawning cmd.exe
Detects processes spawning cmd.exe excluding cmd instances spawned from services.exe or svchost.exe to focus on the most possible suspicious behavior.
Microsoft Sentinel (KQL)
Detects processes spawning cmd.exe excluding cmd instances spawned from services.exe or svchost.exe to focus on the most possible suspicious behavior.
Already have an account?