Sigma rule: Potential Shellcode Injection

Rule

Title

Potential Shellcode Injection

Status

test

Level

medium

Author

Bhabesh Raj

Date

2022-03-11

Modified

2026-09-15

File

rules-threat-hunting/windows/process_access/proc_access_win_susp_potential_shellcode_injection.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential shellcode injection as seen used by tools such as Metasploit's migrate and Empire's psinject.

Log source

product

windows

category

process_access

Detection

selection:
    GrantedAccess:
        - '0x147a'
        - '0x1f3fff'
    CallTrace|contains: 'UNKNOWN'
filter_main_wmiprvse:
    SourceImage: 'C:\Windows\System32\Wbem\Wmiprvse.exe'
    TargetImage: 'C:\Windows\system32\lsass.exe'
filter_optional_dell_folders:
    # If dell software is installed we get matches like these
    # Example 1:
    #   SourceImage: C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
    #   TargetImage: C:\Program Files\Dell\TechHub\Dell.TechHub.exe
    #   GrantedAccess: 0x1F3FFF
    # Example 2:
    #   SourceImage: C:\Program Files (x86)\Dell\UpdateService\DCF\Dell.DCF.UA.Bradbury.API.SubAgent.exe
    #   TargetImage: C:\Program Files\Dell\TechHub\Dell.TechHub.exe
    #   GrantedAccess: 0x1F3FFF
    # Example 3:
    #   SourceImage: C:\Program Files\Dell\TechHub\Dell.TechHub.exe
    #   TargetImage: C:\Program Files (x86)\Dell\UpdateService\DCF\Dell.DCF.UA.Bradbury.API.SubAgent.exe
    #   GrantedAccess: 0x1F3FFF
    SourceImage|startswith:
        - 'C:\Program Files\Dell\'
        - 'C:\Program Files (x86)\Dell\'
    TargetImage|startswith:
        - 'C:\Program Files\Dell\'
        - 'C:\Program Files (x86)\Dell\'
filter_optional_dell_specifc:
    SourceImage: 'C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe'
    TargetImage: 'C:\Windows\Explorer.EXE'
filter_optional_visual_studio:
    SourceImage|startswith: 'C:\Program Files\Microsoft Visual Studio\'
    TargetImage|startswith: 'C:\Program Files\Microsoft Visual Studio\'
filter_optional_avira:
    SourceImage|contains: '\Avira'
    TargetImage|contains: '\Avira\'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.stealth
• attack.t1055
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1055

References

• https://github.com/EmpireProject/PSInject

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/process_access/proc_access_win_susp_potential_shellcode_injection.yml