Investigate `Potential Reverse Shell via Suspicious Child Process`

[cavokz]

https://github.com/elastic/geneve/blob/main/tests/reports/alerts_from_rules-8.9.md#potential-reverse-shell-via-suspicious-child-process
https://github.com/elastic/geneve/blob/main/tests/reports/alerts_from_rules-8.9.md#potential-reverse-shell-via-suspicious-child-process-1