Sigma rule: Potential Meterpreter/CobaltStrike Activity

Rule

Title

Potential Meterpreter/CobaltStrike Activity

Status

test

Level

high

Author

Teymur Kheirkhabarov, Ecco, Florian Roth

Date

2019-10-26

Modified

2023-02-05

File

rules/windows/process_creation/proc_creation_win_hktl_meterpreter_getsystem.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting

Log source

product

windows

category

process_creation

Detection

selection_img:
    ParentImage|endswith: '\services.exe'
selection_technique_1:
    # Examples:
    #   Meterpreter  getsystem technique 1: cmd.exe /c echo 559891bb017 > \\.\pipe\5e120a
    #   CobaltStrike getsystem technique 1b (expanded env var): %COMSPEC% /c echo 559891bb017 > \\.\pipe\5e120a
    #   CobaltStrike getsystem technique 1: %COMSPEC% /c echo 559891bb017 > \\.\pipe\5e120a
    CommandLine|contains|all:
        - '/c'
        - 'echo'
        - '\pipe\'
    CommandLine|contains:
        - 'cmd'
        - '%COMSPEC%'
selection_technique_2:
    # meterpreter getsystem technique 2: rundll32.exe C:\Users\test\AppData\Local\Temp\tmexsn.dll,a /p:tmexsn
    CommandLine|contains|all:
        - 'rundll32'
        - '.dll,a'
        - '/p:'
filter_defender:
    CommandLine|contains: 'MpCmdRun'
condition: selection_img and 1 of selection_technique_* and not 1 of filter_*

False positives (as the rule lists them)

• Commandlines containing components like cmd accidentally
• Jobs and services started with cmd

Tags

• attack.privilege-escalation
• attack.stealth
• attack.t1134.001
• attack.t1134.002

MITRE ATT&CK ids this rule names

• T1134.001
• T1134.002

References

• https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
• https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_hktl_meterpreter_getsystem.yml