Windows: Abused Debug Privilege via Command-Line Route/Add Spawned by System Parents
Flags PowerShell/cmd spawned by system processes with command lines containing both 'route' and 'ADD'.
- Product
- windows
- Category
- process_creation
- Author
- Semanur Guneysu @semanurtg, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-28
- Updated
- 2026-07-30
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies suspicious child processes (PowerShell or cmd) spawned by common Windows system processes under specific user name patterns. It matters because attackers may leverage these high-trust parent contexts to establish execution paths associated with privilege escalation attempts. The detection relies on Windows process creation telemetry, matching parent image endings, child image/original file name indicators, and command-line content containing both 'route' and 'ADD'.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Abused Debug Privilege via Command-Line Route/Add Spawned by System Parents"
id: 096d412c-ccdd-49a9-9e6d-bbb04ce9103c
status: test
description: This rule identifies suspicious child processes (PowerShell or cmd) spawned by common Windows system processes under specific user name patterns. It matters because attackers may leverage these high-trust parent contexts to establish execution paths associated with privilege escalation attempts. The detection relies on Windows process creation telemetry, matching parent image endings, child image/original file name indicators, and command-line content containing both 'route' and 'ADD'.
references:
- https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-74-638.jpg
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_abusing_debug_privilege.yml
author: Semanur Guneysu @semanurtg, oscd.community, Huntrule Team
date: 2020-10-28
modified: 2022-11-11
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
product: windows
category: process_creation
detection:
selection_parent:
ParentImage|endswith:
- \winlogon.exe
- \services.exe
- \lsass.exe
- \csrss.exe
- \smss.exe
- \wininit.exe
- \spoolsv.exe
- \searchindexer.exe
User|contains:
- AUTHORI
- AUTORI
selection_img:
- Image|endswith:
- \powershell.exe
- \pwsh.exe
- \cmd.exe
- OriginalFileName:
- PowerShell.EXE
- pwsh.dll
- Cmd.Exe
filter:
CommandLine|contains|all:
- " route "
- " ADD "
condition: all of selection_* and not filter
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: d522eca2-2973-4391-a3e0-ef0374321dae
type: derived