Detectionmediumtest

Sysinternals PsSuspend Execution

Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Thu Mar 2348bbc537-b652-4b4e-bd1d-281172df448fwindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        - OriginalFileName: 'pssuspend.exe'
        - Image|endswith:
              - '\pssuspend.exe'
              - '\pssuspend64.exe'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0004 · Privilege Escalation TA0007 · Discovery TA0003 · Persistence

Sub-techniques

T1543.003 · Windows Service

Related Rules

SimilarDetectionhigh

Sysinternals PsSuspend Suspicious Execution

Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

48bbc537-b652-4b4e-bd1d-281172df448f

Status

test

Level

medium

Type

Detection

Created

Thu Mar 23

Author

Nasreddine Bencherchali (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_sysinternals_pssuspend_execution.yml

Raw Tags

attack.privilege-escalationattack.discoveryattack.persistenceattack.t1543.003

View on GitHub