hightestEmerging Threat
Suspicious Sysmon as Execution Parent
Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)
windowsprocess_creation
2025-07-04
Emerging Threats
CVE2022
CVE-2022-41120
1Rules
3References
1Folders
2025-07-04Latest
Summary
CVE-2022-41120 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2022. Coverage centers on windows / process_creation.
Related Detections
Search this threatReferences