Windows Process Access to Uncommon Target Images Using PROCESS_ALL_ACCESS
Alerts on Windows events granting PROCESS_ALL_ACCESS to processes with uncommon target image filenames.
- Product
- windows
- Category
- process_access
- Author
- Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
- Published
- 2024-05-27
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process access requests where the target image filename ends with a common user application (e.g., calc.exe, notepad.exe, mspaint.exe) and the granted access mask is PROCESS_ALL_ACCESS. Attackers can use full process rights to inspect, modify, or interfere with another process, which is often leveraged during stealthy privilege escalation or tampering. The detection relies on Windows process-access telemetry that includes the target image path/name and the granted access mask.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Access to Uncommon Target Images Using PROCESS_ALL_ACCESS
id: 022b4db6-1993-46c8-a38e-daf1aec436ce
status: test
description: This rule flags process access requests where the target image filename ends with a common user application (e.g., calc.exe, notepad.exe, mspaint.exe) and the granted access mask is PROCESS_ALL_ACCESS. Attackers can use full process rights to inspect, modify, or interfere with another process, which is often leveraged during stealthy privilege escalation or tampering. The detection relies on Windows process-access telemetry that includes the target image path/name and the granted access mask.
references:
- https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_susp_all_access_uncommon_target.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2024-05-27
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1055.011
logsource:
category: process_access
product: windows
detection:
selection:
TargetImage|endswith:
- \calc.exe
- \calculator.exe
- \mspaint.exe
- \notepad.exe
- \ping.exe
- \wordpad.exe
- \write.exe
GrantedAccess: "0x1FFFFF"
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: a24e5861-c6ca-4fde-a93c-ba9256feddf0
type: derived