Sigma rule: Meterpreter or Cobalt Strike Getsystem Service Installation

Rule

Title

Meterpreter or Cobalt Strike Getsystem Service Installation

Status

unsupported

Level

critical

Author

Teymur Kheirkhabarov, Ecco, Florian Roth

Date

2019/10/26

Modified

2022/12/22

File

unsupported/windows/driver_load_meterpreter_or_cobaltstrike_getsystem_service_installation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Log source

product

windows

category

driver_load

Detection

selection:
    # meterpreter getsystem technique 1: cmd.exe /c echo 559891bb017 > \\.\pipe\5e120a
    - ImagePath|contains|all:
        - 'cmd'
        - '/c'
        - 'echo'
        - '\pipe\'
    # cobaltstrike getsystem technique 1: %COMSPEC% /c echo 559891bb017 > \\.\pipe\5e120a
    - ImagePath|contains|all:
        - '%COMSPEC%'
        - '/c'
        - 'echo'
        - '\pipe\'
    # cobaltstrike getsystem technique 1b (expanded %COMSPEC%): %COMSPEC% /c echo 559891bb017 > \\.\pipe\5e120a
    - ImagePath|contains|all:
        - 'cmd.exe'
        - '/c'
        - 'echo'
        - '\pipe\'
    # meterpreter getsystem technique 2: rundll32.exe C:\Users\test\AppData\Local\Temp\tmexsn.dll,a /p:tmexsn
    - ImagePath|contains|all:
        - 'rundll32'
        - '.dll,a'
        - '/p:'
condition: selection

False positives (as the rule lists them)

• Highly unlikely

Tags

• attack.privilege_escalation
• attack.t1134.001
• attack.t1134.002

MITRE ATT&CK ids this rule names

• T1134.001
• T1134.002

Related rules

• 843544a7-56e0-4dcc-a44f-5cc266dd97d6 (derived)

References

• https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
• https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/unsupported/windows/driver_load_meterpreter_or_cobaltstrike_getsystem_service_installation.yml