Sigma rule: Suspicious SYSTEM User Process Creation

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-537c11f694b1, updated 2025-10-19T00:00:00.000Z.

Rule

Title
Suspicious SYSTEM User Process Creation
Status
test
Level
high
Author
Florian Roth (Nextron Systems), David ANDRE (additional keywords)
Date
2021-12-20
Modified
2025-10-19
File
rules/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml
Commit
ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Log source

product
windows
category
process_creation

Detection

selection:
    IntegrityLevel:
        - 'System'
        - 'S-1-16-16384'
    User|contains: # covers many language settings
        - 'AUTHORI'
        - 'AUTORI'
selection_special:
    - Image|endswith:
          - '\calc.exe'
          - '\cscript.exe'
          - '\forfiles.exe'
          - '\hh.exe'
          - '\mshta.exe'
          - '\ping.exe'
          - '\wscript.exe'
    - CommandLine|re: 'net\s+user\s+'
    - CommandLine|contains:
          # - 'sc stop ' # stops a system service # causes FPs
          - ' -NoP '  # Often used in malicious PowerShell commands
          - ' -W Hidden '  # Often used in malicious PowerShell commands
          - ' -decode '  # Used with certutil
          - ' /decode '  # Used with certutil
          - ' /urlcache '  # Used with certutil
          - ' -urlcache '  # Used with certutil
          - ' -e* JAB'  # PowerShell encoded commands
          - ' -e* SUVYI'  # PowerShell encoded commands
          - ' -e* SQBFAFgA'  # PowerShell encoded commands
          - ' -e* aWV4I'  # PowerShell encoded commands
          - ' -e* IAB'  # PowerShell encoded commands
          - ' -e* PAA'  # PowerShell encoded commands
          - ' -e* aQBlAHgA'  # PowerShell encoded commands
          - 'vssadmin delete shadows'  # Ransomware
          - 'reg SAVE HKLM'  # save registry SAM - syskey extraction
          - ' -ma '  # ProcDump
          - 'Microsoft\Windows\CurrentVersion\Run'  # Run key in command line - often in combination with REG ADD
          - '.downloadstring('  # PowerShell download command
          - '.downloadfile('  # PowerShell download command
          - ' /ticket:'  # Rubeus
          - 'dpapi::'     # Mimikatz
          - 'event::clear'        # Mimikatz
          - 'event::drop'     # Mimikatz
          - 'id::modify'      # Mimikatz
          - 'kerberos::'       # Mimikatz
          - 'lsadump::'      # Mimikatz
          - 'misc::'     # Mimikatz
          - 'privilege::'       # Mimikatz
          - 'rpc::'      # Mimikatz
          - 'sekurlsa::'       # Mimikatz
          - 'sid::'        # Mimikatz
          - 'token::'      # Mimikatz
          - 'vault::cred'     # Mimikatz
          - 'vault::list'     # Mimikatz
          - ' p::d '  # Mimikatz
          - ';iex('  # PowerShell IEX
          - 'MiniDump'  # Process dumping method apart from procdump
filter_main_ping:
    CommandLine|contains|all:
        - 'ping'
        - '127.0.0.1'
        - ' -n '
filter_vs:
    Image|endswith: '\PING.EXE'
    ParentCommandLine|contains: '\DismFoDInstall.cmd'
filter_config_mgr:
    ParentImage|contains: ':\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\'
filter_java:
    ParentImage|contains:
        - ':\Program Files (x86)\Java\'
        - ':\Program Files\Java\'
    ParentImage|endswith: '\bin\javaws.exe'
    Image|contains:
        - ':\Program Files (x86)\Java\'
        - ':\Program Files\Java\'
    Image|endswith: '\bin\jp2launcher.exe'
    CommandLine|contains: ' -ma '
condition: all of selection* and not 1 of filter_*

False positives (as the rule lists them)

  • Administrative activity
  • Scripts and administrative tools used in the monitored environment
  • Monitoring activity

Tags

  • attack.credential-access
  • attack.privilege-escalation
  • attack.stealth
  • attack.t1134
  • attack.t1003
  • attack.t1027

MITRE ATT&CK ids this rule names

References

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml

Sources and licences

  • SigmaHQ

    "Suspicious SYSTEM User Process Creation" by Florian Roth (Nextron Systems), David ANDRE (additional keywords) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml.
    Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License

    Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: Suspicious SYSTEM User Process Creation",
entity page, dataset version ref-537c11f694b1, updated 2025-10-19T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/2617e7ed-adb7-40ba-b0f3-8f9945fe6c09 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.