Suspicious Cross-User Process Spawn

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects suspicious spawning of a process under a different user context than the parent process. Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.

2026-07-23 00:00:00

None

d2b7a134-9c3e-4f8a-b56d-e0c1f8a29b47

attack.privilege-escalation attack.stealth attack.t1055 attack.t1134

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #6169 from @swachchhanda000 - Add LegacyHive Indicators

2026-08-03