Suspicious Windows Process Creation as SYSTEM User with Likely Credential/Defense Evasion Commands

title: Suspicious Windows Process Creation as SYSTEM User with Likely Credential/Defense Evasion Commands
id: b0563ef4-5158-40df-9a97-3e5fac66c0d2
status: test
description: This rule flags Windows process creation events where the process runs under the SYSTEM security context (IntegrityLevel values like System and S-1-16-16384) and the image or command line matches a set of suspicious tool and behavior indicators. The activity matters because attackers commonly leverage SYSTEM execution to perform stealthy credential access, privilege escalation, and persistence using built-in binaries or encoded PowerShell and Mimikatz-like command patterns. It relies on process creation telemetry including the creating user/integrity context, process image path, command line, and parent process details for multiple false-positive filters.
references:
  - Internal Research
  - https://tools.thehacker.recipes/mimikatz/modules
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml
author: Florian Roth (Nextron Systems), David ANDRE (additional keywords), Huntrule Team
date: 2021-12-20
modified: 2025-10-19
tags:
  - attack.credential-access
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1134
  - attack.t1003
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    IntegrityLevel:
      - System
      - S-1-16-16384
    User|contains:
      - AUTHORI
      - AUTORI
  selection_special:
    - Image|endswith:
        - \calc.exe
        - \cscript.exe
        - \forfiles.exe
        - \hh.exe
        - \mshta.exe
        - \ping.exe
        - \wscript.exe
    - CommandLine|re: net\s+user\s+
    - CommandLine|contains:
        - " -NoP "
        - " -W Hidden "
        - " -decode "
        - " /decode "
        - " /urlcache "
        - " -urlcache "
        - " -e* JAB"
        - " -e* SUVYI"
        - " -e* SQBFAFgA"
        - " -e* aWV4I"
        - " -e* IAB"
        - " -e* PAA"
        - " -e* aQBlAHgA"
        - vssadmin delete shadows
        - reg SAVE HKLM
        - " -ma "
        - Microsoft\Windows\CurrentVersion\Run
        - .downloadstring(
        - .downloadfile(
        - " /ticket:"
        - "dpapi::"
        - event::clear
        - event::drop
        - id::modify
        - "kerberos::"
        - "lsadump::"
        - "misc::"
        - "privilege::"
        - "rpc::"
        - "sekurlsa::"
        - "sid::"
        - "token::"
        - vault::cred
        - vault::list
        - " p::d "
        - ;iex(
        - MiniDump
  filter_main_ping:
    CommandLine|contains|all:
      - ping
      - 127.0.0.1
      - " -n "
  filter_vs:
    Image|endswith: \PING.EXE
    ParentCommandLine|contains: \DismFoDInstall.cmd
  filter_config_mgr:
    ParentImage|contains: :\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\
  filter_java:
    ParentImage|contains:
      - :\Program Files (x86)\Java\
      - :\Program Files\Java\
    ParentImage|endswith: \bin\javaws.exe
    Image|contains:
      - :\Program Files (x86)\Java\
      - :\Program Files\Java\
    Image|endswith: \bin\jp2launcher.exe
    CommandLine|contains: " -ma "
  condition: all of selection* and not 1 of filter_*
falsepositives:
  - Administrative activity
  - Scripts and administrative tools used in the monitored environment
  - Monitoring activity
level: high
license: DRL-1.1
related:
  - id: 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09
    type: derived