Windows Shell/Scripting Processes Spawning Suspicious Programs (3a6586ad-127a-4d3b-a677-1e6eacdf8fde)

Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736)	Attack Pattern	Windows Shell/Scripting Processes Spawning Suspicious Programs (3a6586ad-127a-4d3b-a677-1e6eacdf8fde)	Sigma-Rules	1
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	Windows Shell/Scripting Processes Spawning Suspicious Programs (3a6586ad-127a-4d3b-a677-1e6eacdf8fde)	Sigma-Rules	1
Visual Basic - T1059.005 (dfd7cc1d-e1d8-4394-a198-97c4cab8aa67)	Attack Pattern	Windows Shell/Scripting Processes Spawning Suspicious Programs (3a6586ad-127a-4d3b-a677-1e6eacdf8fde)	Sigma-Rules	1
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736)	Attack Pattern	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	2
Visual Basic - T1059.005 (dfd7cc1d-e1d8-4394-a198-97c4cab8aa67)	Attack Pattern	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	2