Sigma rule: Uncommon Userinit Child Process

Rule

Title

Uncommon Userinit Child Process

Status

test

Level

high

Author

Tom Ueltschi (@c_APT_ure), Tim Shelton

Date

2019-01-12

Modified

2023-11-14

File

rules/windows/process_creation/proc_creation_win_userinit_uncommon_child_processes.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.

Log source

product

windows

category

process_creation

Detection

selection:
    ParentImage|endswith: '\userinit.exe'
filter_main_explorer:
    Image|endswith: ':\WINDOWS\explorer.exe'
filter_optional_logonscripts:
    CommandLine|contains:
        - 'netlogon.bat'
        - 'UsrLogon.cmd'
filter_optional_windows_core:
    # Note: This filter is mandatory on Windows Core machines as the default shell spawned by "userinit" is "powershell.exe".
    # https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig#powershell-is-the-default-shell-on-server-core
    CommandLine: 'PowerShell.exe'
filter_optional_proquota:
    Image|endswith:
        - ':\Windows\System32\proquota.exe'
        - ':\Windows\SysWOW64\proquota.exe'
filter_optional_citrix:
    Image|endswith:
        # As reported by https://github.com/SigmaHQ/sigma/issues/4569
        - ':\Program Files (x86)\Citrix\HDX\bin\cmstart.exe' # https://support.citrix.com/article/CTX983798/purpose-of-cmstart-command
        - ':\Program Files (x86)\Citrix\HDX\bin\icast.exe' # https://support.citrix.com/article/CTX983798/purpose-of-cmstart-command
        - ':\Program Files (x86)\Citrix\System32\icast.exe'
        - ':\Program Files\Citrix\HDX\bin\cmstart.exe' # https://support.citrix.com/article/CTX983798/purpose-of-cmstart-command
        - ':\Program Files\Citrix\HDX\bin\icast.exe' # https://support.citrix.com/article/CTX983798/purpose-of-cmstart-command
        - ':\Program Files\Citrix\System32\icast.exe'
filter_optional_image_null:
    Image: null
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate logon scripts or custom shells may trigger false positives. Apply additional filters accordingly.

Tags

• attack.privilege-escalation
• attack.t1037.001
• attack.persistence

MITRE ATT&CK ids this rule names

• T1037.001

Related rules

• 21d856f9-9281-4ded-9377-51a1a6e2a432 (similar)

References

• https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html
• https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig#powershell-is-the-default-shell-on-server-core

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_userinit_uncommon_child_processes.yml