#100DaysOfKQL

Day 25 - Suspicious Child Process Launched by Office Process

I should've posted this one on a #TBT in retrospect. Kind of a nostalgic query in terms of what it implies/looks for. Sometimes simple is best!

I really need to move out of MDE

github.com/SecurityAura...