This experimental Windows rule detects suspicious cross-user spawning of common sacrificial/decoy processes by monitoring process creation events where a child process runs under a different user context than its parent. It targets decoy binaries typically used in privilege escalation or stealth testing (notepad.exe, calc.exe, mspaint.exe, wordpad.exe, write.exe) by matching the Image path (endswith these names) and comparing User and ParentUser. The condition requires both User and ParentUser to be present (non-null/non-empty) and to differ, ensuring a cross-user context rather than same-user execution. This reduces noise in single-user scenarios but flags cases where a process is created under a different account, which may indicate privilege escalation, token manipulation, or RunAs-like activity. The rule is categorized under process_creation for Windows endpoints and is associated with attack themes such as privilege escalation and stealth (tags reference T1055 and T1134). It includes explicit false-positive notes acknowledging RunAs usage spawning decoys under a different account and documents regression test data. Overall, it provides a focused signal for anomalous cross-user process spawns, with a medium level of confidence and a design intent to balance precision against coverage in multi-user environments.