WSL Child Process Anomaly (2267fe65-0681-42ad-9a6d-46553d3f3480)
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL