Suspicious SYSTEM User Process Creation — Detection Rule

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Read the full analysis on IntelFusions