Threat hunting — Popular process misbehaving

My favorite type of detection rules are the ones that do not rely on any upfront threat intelligence signals. No domains, IPs, commands…