Windows Shell/Scripting Processes Spawning Suspicious Programs — Detection Rule

Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.