Potentially Suspicious PowerShell Child Processes — Detection Rule

Detects potentially suspicious child processes spawned by PowerShell. Use this rule to hunt for potential anomalies initiating from PowerShell scripts and commands.

Read the full analysis on IntelFusions