New Process Created Via Taskmgr.EXE — Detection Rule

Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC

Read the full analysis on IntelFusions