This Splunk/analytic detects shells, scripting engines, and common post-exploitation utilities spawned as child processes of smsexec.exe, the core SCCM SMS Executive service process. In normal operation, smsexec.exe should not launch interactive shells or scripting interpreters. An attacker who injects a malicious adsource.dll into SCCMProvider bin\X64 can cause the SCCM service to execute code in its context, often resulting in a SYSTEM-level child process under smsexec.exe. The rule leverages endpoint telemetry (Sysmon EventID 1, Windows Security log 4688, and CrowdStrike ProcessRollup2) to identify a parent-child relationship where parent_process_name = smsexec.exe and the child process matches a set of known post-exploitation utilities (e.g., bitsadmin.exe, certutil.exe, cmd.exe, conhost.exe, cscript.exe, curl.exe, mshta.exe, net.exe, net1.exe, powershell.exe, pwsh.exe, reg.exe, regsvr32.exe, rundll32.exe, wmic.exe, wscript.exe). The detection is presented as an anomaly with contextual metadata to facilitate triage, containment, and investigation. If a match is confirmed malicious, it indicates a full host compromise. False positives are unlikely; validate full command line and file hash before tuning. The rule is designed to be ingested with the Endpoint data model and CIM-normalized fields to support rapid investigation and response.