Suspicious Child Process Created as System — Detection Rule

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts