Windows Process Creation: Alert on Suspicious Parent of Core System Executables

Flags when core Windows executables (e.g., svchost, lsass, winlogon) are spawned by suspicious parent processes.

FreeUnreviewedSigmalowv1

windows-process-creation-alert-on-suspicious-parent-of-core-system-executables-96036718

title: "Windows Process Creation: Alert on Suspicious Parent of Core System Executables"
id: 24f760b2-9f33-4138-844e-bfb178e6aceb
status: test
description: This rule flags Windows process creation events where a well-known system executable is launched with an uncommon or suspicious parent process. Attackers may use living-off-the-land techniques or process masquerading to blend into normal Windows activity, making parent-child process relationships important for triage. It relies on process creation telemetry including the child Image path and the ParentImage path, with additional exclusions for known benign parent locations and Defender-related parents.
references:
  - https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2
  - https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/
  - https://www.13cubed.com/downloads/windows_process_genealogy_v2.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_proc_wrong_parent.yml
author: vburov, Huntrule Team
date: 2019-02-23
modified: 2025-03-06
tags:
  - attack.stealth
  - attack.t1036.003
  - attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \svchost.exe
      - \taskhost.exe
      - \lsm.exe
      - \lsass.exe
      - \services.exe
      - \lsaiso.exe
      - \csrss.exe
      - \wininit.exe
      - \winlogon.exe
  filter_sys:
    - ParentImage|endswith:
        - \SavService.exe
        - \ngen.exe
    - ParentImage|contains:
        - \System32\
        - \SysWOW64\
  filter_msmpeng:
    ParentImage|contains:
      - \Windows Defender\
      - \Microsoft Security Client\
    ParentImage|endswith: \MsMpEng.exe
  filter_null:
    - ParentImage: null
    - ParentImage:
        - ""
        - "-"
  condition: selection and not 1 of filter_*
falsepositives:
  - Some security products seem to spawn these
level: low
license: DRL-1.1
related:
  - id: 96036718-71cc-4027-a538-d1587e0006a7
    type: derived

What it detects

This rule flags Windows process creation events where a well-known system executable is launched with an uncommon or suspicious parent process. Attackers may use living-off-the-land techniques or process masquerading to blend into normal Windows activity, making parent-child process relationships important for triage. It relies on process creation telemetry including the child Image path and the ParentImage path, with additional exclusions for known benign parent locations and Defender-related parents.

Known false positives

Some security products seem to spawn these

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.