Abused Debug Privilege by Arbitrary Parent Processes — Detection Rule

Detection of unusual child processes by different system processes

Read the full analysis on IntelFusions