Suspicious Microsoft OneNote Child Process — Detection Rule

Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.

Read the full analysis on IntelFusions