Suspicious Process Parents — Detection Rule

Detects suspicious parent processes that should not have any children or should only have a single possible child program