Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

Blocklisted process makes network request

Executes dropped EXE

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.