Suspicious SysAidServer Child — Detection Rule

Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)

Read the full analysis on IntelFusions