Sdiagnhost Calling Suspicious Child Process — Detection Rule

Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)

Read the full analysis on IntelFusions