Threat Huntmediumtest
Elevated System Shell Spawned
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. Use this rule to hunt for potential suspicious processes.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems), François HubautCreated Thu Nov 23Updated Thu Mar 0661065c72-5d7d-44ef-bf41-6a36684b545fwindows
Hunting Hypothesis
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic2 selectors
detection:
selection_shell:
- Image|endswith:
- '\powershell.exe'
- '\powershell_ise.exe'
- '\pwsh.exe'
- '\cmd.exe'
- OriginalFileName:
- 'PowerShell.EXE'
- 'powershell_ise.EXE'
- 'pwsh.dll'
- 'Cmd.Exe'
selection_user:
User|contains: # covers many language settings
- 'AUTHORI'
- 'AUTORI'
LogonId: '0x3e7'
condition: all of selection_*False Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
References
MITRE ATT&CK
Other
detection.threat-hunting
Rule Metadata
Rule ID
61065c72-5d7d-44ef-bf41-6a36684b545f
Status
test
Level
medium
Type
Threat Hunt
Created
Thu Nov 23
Modified
Thu Mar 06
Path
rules-threat-hunting/windows/process_creation/proc_creation_win_susp_elevated_system_shell.yml
Raw Tags
attack.privilege-escalationattack.defense-evasionattack.executionattack.t1059detection.threat-hunting