Sigma rule: Potential Executable Run Itself As Sacrificial Process

Rule

Title

Potential Executable Run Itself As Sacrificial Process

Status

experimental

Level

low

Author

frack113

Date

2025-10-17

File

rules-threat-hunting/windows/process_creation/proc_creation_win_susp_parent_execute_itself.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when an executable launches an identical instance of itself, a behavior often used to create a suspended “sacrificial” process for code injection or evasion.
Investigate for indicators such as the process being started in suspended mode, rapid parent termination, memory manipulation (e.g., WriteProcessMemory, CreateRemoteThread), or unsigned binaries.
Review command-line arguments, process ancestry, and network activity to confirm if this is legitimate behavior or process injection activity.

Log source

product

windows

category

process_creation

Detection

selection:
    Image|fieldref: ParentImage
filter_main_path:
    Image|startswith:
        - 'C:\Program Files\'
        - 'C:\Program Files (x86)\'
filter_main_original_fn:
    OriginalFileName:
        - 'Cmd.Exe'
        - 'CompatTelRunner.exe'
        - 'Discord.exe'
        - 'electron.exe' # Vs Code
        - 'EXPLORER.EXE'
        - 'httpd.exe'
        - 'IE4UINIT.EXE'
        - 'mmc.exe'
        - 'MpCmdRun.exe'
        - 'mscorsvw.exe'
        - 'msiexec.exe'
        - 'NGenTask.exe'
        - 'OneDriveSetup.exe'
        - 'PowerShell.EXE'
        - 'REGSVR32.EXE'
        - 'smss.exe'
        - 'Spotify.exe'
        - 'WerMgr'
filter_main_product:
    Product:
        - 'Avira'
        - 'Evernote'
        - 'Firefox'
        - 'Microsoft Office'
        - 'Ninite'
        - 'Opera Browser Assistant Installer'
        - 'Opera Installer'
        - 'Sysinternals Sysmon'
condition: selection and not 1 of filter_*

False positives (as the rule lists them)

• Legitimate software that may launch a new instance of itself, especially updaters or installers. Investigate each alert and apply whitelisting as needed.

Tags

• attack.privilege-escalation
• attack.stealth
• attack.t1055
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1055

References

• https://www.joesandbox.com/analysis/1605063/0/html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_parent_execute_itself.yml