Detects unexpected child processes spawned by consent.exe, the Windows UAC consent dialog binary. Under normal operation, consent.exe should not create child processes; spawning children is a known indicator of UAC bypass and privilege escalation attempts. The rule filters out legitimate WerFault.exe crashes, which may legitimately appear as a child process in crash scenarios, to reduce noise. Data sources include Sysmon Process creation events, Windows Security event 4688, and CrowdStrike ProcessRollup2. The search targets any executable launched as a child of consent.exe (excluding WerFault.exe) and surfaces rich metadata such as parent/child names, paths, process hashes, GUIs, and user context. This aligns with Windows Privilege Escalation and Unusual Processes detection, and supports investigation through linked risk/rule history and annotations. The rule is designed for endpoint telemetry ingestion via EDR, normalized with CIM, and is most effective when data is mapped to the Endpoint Processes model. Known false positives can occur during legitimate software installations or system updates, so flagged activity should be correlated with admin actions or recent software changes before raising an alert.