Sigma rule: Suspicious Cross-User Process Spawn

Rule

Title

Suspicious Cross-User Process Spawn

Status

experimental

Level

medium

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-07-23

File

rules/windows/process_creation/proc_creation_win_susp_cross_user_process_spawn.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious spawning of a process under a different user context than the parent process.
Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and
also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.

Log source

product

windows

category

process_creation

Detection

selection:
    Image|endswith:
        - '\notepad.exe'
        - '\calc.exe'
        - '\mspaint.exe'
        - '\wordpad.exe'
        - '\write.exe'
filter_main_same_user:
    User|fieldref: ParentUser
filter_optional_user_null:
    User: null
filter_optional_parent_null:
    ParentUser: null
filter_optional_empty_user:
    - ParentUser:
          - ''
          - '-'
    - User:
          - ''
          - '-'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• RunAs usage spawning one of the listed binaries under a different account

Tags

• attack.privilege-escalation
• attack.stealth
• attack.t1055
• attack.t1134

MITRE ATT&CK ids this rule names

• T1055
• T1134

References

• https://github.com/MSNightmare/LegacyHive
• https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_cross_user_process_spawn.yml