Detecting Process code Injection using MS supported methods

@@ The question still remains what is the process doing opening another
process in the first place? @@

The process access mask does not really reveal the motive. We can group set
of probable activities that may be possible but cannot pinpoint any
activity.

@@ challenge is always questionable @@

Exactly.