Does squid:S4721 pick up use of ProcessBuilder?

I just ran your sample in our unit test suite and it is properly detected : is the rule activated in your quality profile ? can you share the log of the analysis ?
What is the sonarjava version installed on your sonarqube instance ?
The problem of false negative does not seem to be related to the rule itself but to something else.