Windows: Abused Debug Privilege via Command-Line Route/Add Spawned by System Parents

title: "Windows: Abused Debug Privilege via Command-Line Route/Add Spawned by System Parents"
id: 096d412c-ccdd-49a9-9e6d-bbb04ce9103c
status: test
description: This rule identifies suspicious child processes (PowerShell or cmd) spawned by common Windows system processes under specific user name patterns. It matters because attackers may leverage these high-trust parent contexts to establish execution paths associated with privilege escalation attempts. The detection relies on Windows process creation telemetry, matching parent image endings, child image/original file name indicators, and command-line content containing both 'route' and 'ADD'.
references:
  - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-74-638.jpg
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_abusing_debug_privilege.yml
author: Semanur Guneysu @semanurtg, oscd.community, Huntrule Team
date: 2020-10-28
modified: 2022-11-11
tags:
  - attack.privilege-escalation
  - attack.t1548
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - \winlogon.exe
      - \services.exe
      - \lsass.exe
      - \csrss.exe
      - \smss.exe
      - \wininit.exe
      - \spoolsv.exe
      - \searchindexer.exe
    User|contains:
      - AUTHORI
      - AUTORI
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
        - \cmd.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
        - Cmd.Exe
  filter:
    CommandLine|contains|all:
      - " route "
      - " ADD "
  condition: all of selection_* and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: d522eca2-2973-4391-a3e0-ef0374321dae
    type: derived