Sigma rule: Suspicious Child Process Created as System

Rule

Title

Suspicious Child Process Created as System

Status

test

Level

high

Author

Teymur Kheirkhabarov, Roberto Rodriguez (@Cyb3rWard0g), Open Threat Research (OTR)

Date

2019-10-26

Modified

2024-12-01

File

rules/windows/process_creation/proc_creation_win_susp_child_process_as_system_.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts

Log source

product

windows

category

process_creation

definition

Requirements: ParentUser field needs sysmon >= 13.30

Detection

selection:
    ParentUser|contains:
        - 'AUTHORI'
        - 'AUTORI'
    ParentUser|endswith:
        - '\NETWORK SERVICE'
        - '\LOCAL SERVICE'
    User|contains: # covers many language settings
        - 'AUTHORI'
        - 'AUTORI'
    User|endswith: # System
        - '\SYSTEM'
        - '\Système'
        - '\СИСТЕМА'
    IntegrityLevel:
        - 'System'
        - 'S-1-16-16384'
filter_rundll32:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains: 'DavSetCookie'
condition: selection and not 1 of filter_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.stealth
• attack.t1134.002

MITRE ATT&CK ids this rule names

• T1134.002

References

• https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
• https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/
• https://github.com/antonioCoco/RogueWinRM
• https://twitter.com/Cyb3rWard0g/status/1453123054243024897

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_child_process_as_system_.yml