Interactive Bash Suspicious Children — Detection Rule

Detects suspicious interactive bash as a parent to rather uncommon child processes

Read the full analysis on IntelFusions