Sigma rule: Elevated System Shell Spawned From Uncommon Parent Location

Rule

Title

Elevated System Shell Spawned From Uncommon Parent Location

Status

test

Level

medium

Author

frack113, Tim Shelton (update fp)

Date

2022-12-05

Modified

2025-03-06

File

rules/windows/process_creation/proc_creation_win_susp_elevated_system_shell_uncommon_parent.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Log source

product

windows

category

process_creation

Detection

selection_shell:
    - Image|endswith:
          - '\powershell.exe'
          - '\powershell_ise.exe'
          - '\pwsh.exe'
          - '\cmd.exe'
    - OriginalFileName:
          - 'PowerShell.EXE'
          - 'powershell_ise.EXE'
          - 'pwsh.dll'
          - 'Cmd.Exe'
selection_user:
    User|contains: # covers many language settings
        - 'AUTHORI'
        - 'AUTORI'
    LogonId: '0x3e7'
filter_main_generic:
    # Example 1:
    #   C:\Program Files\erl-23.2\erts-11.1.4\bin\erl.exe" -service_event ErlSrv_RabbitMQ -nohup -sname rabbit@localhost -s rabbit boot -boot start_sasl +W w +MBas ageffcbf +MHas ageffcbf +MBlmbcs 512 +MHlmbcs 512 +MMmcs 30 +P 1048576 +t 5000000 +stbt db +zdbbl 128000 +sbwt none +sbwtdcpu none +sbwtdio none -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672 -lager crash_log false -lager handlers []
    # Example 2:
    #   ParentImage: C:\Program Files (x86)\Varonis\DatAdvantage\GridCollector\VrnsRealTimeAlertsSvc.exe" /appid 000000ad-cb03-500b-9459-c46d000000ad
    #   CommandLine: C:\Windows\system32\cmd.exe /c C:\Program Files "(x86)\Varonis\DatAdvantage\GridCollector\handle_scopes.cmd C:\Collector" Working Share\VaronisWorkDirectoryCollector
    ParentImage|contains:
        - ':\Program Files (x86)\'
        - ':\Program Files\'
        - ':\ProgramData\'
        - ':\Windows\System32\'
        - ':\Windows\SysWOW64\'
        - ':\Windows\Temp\' # Installers
        - ':\Windows\WinSxS\'
filter_optional_manageengine:
    # Example:
    #   ParentImage: C:/ManageEngine/ADManager Plus/pgsql/bin/postgres.exe" --forkarch 5380
    #   CommandLine: C:\Windows\system32\cmd.exe /c "IF EXIST archive.bat (archive.bat pg_wal\000000010000008E000000EA 000000010000008E000000EA)
    ParentImage|endswith: ':\ManageEngine\ADManager Plus\pgsql\bin\postgres.exe'
    Image|endswith: '\cmd.exe'
filter_optional_asgard:
    CommandLine|contains: ':\WINDOWS\system32\cmd.exe /c "'
    CurrentDirectory|contains: ':\WINDOWS\Temp\asgard2-agent\'
filter_optional_ibm_spectrumprotect:
    ParentImage|contains: ':\IBM\SpectrumProtect\webserver\scripts\'
    CommandLine|contains: ':\IBM\SpectrumProtect\webserver\scripts\'
filter_main_parent_null:
    ParentImage: null
filter_main_parent_empty:
    ParentImage:
        - ''
        - '-'
condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Some legitimate applications may spawn shells from uncommon parent locations. Apply additional filters and perform an initial baseline before deploying.

Tags

• attack.privilege-escalation
• attack.execution
• attack.t1059

MITRE ATT&CK ids this rule names

• T1059

Related rules

• 61065c72-5d7d-44ef-bf41-6a36684b545f (similar)

References

• https://github.com/Wh04m1001/SysmonEoP

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_elevated_system_shell_uncommon_parent.yml