Windows Process Creation: Alert on Suspicious Parent of Core System Executables
Flags when core Windows executables (e.g., svchost, lsass, winlogon) are spawned by suspicious parent processes.
- Product
- windows
- Category
- process_creation
- Author
- vburov (SigmaHQ), DRL 1.1
- Published
- 2019-02-23
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where a well-known system executable is launched with an uncommon or suspicious parent process. Attackers may use living-off-the-land techniques or process masquerading to blend into normal Windows activity, making parent-child process relationships important for triage. It relies on process creation telemetry including the child Image path and the ParentImage path, with additional exclusions for known benign parent locations and Defender-related parents.
Reporting behind it
- web.archive.orghttps://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2
- carbonblack.comhttps://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/
- 13cubed.comhttps://www.13cubed.com/downloads/windows_process_genealogy_v2.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_proc_wrong_parent.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Alert on Suspicious Parent of Core System Executables"
id: 24f760b2-9f33-4138-844e-bfb178e6aceb
status: test
description: This rule flags Windows process creation events where a well-known system executable is launched with an uncommon or suspicious parent process. Attackers may use living-off-the-land techniques or process masquerading to blend into normal Windows activity, making parent-child process relationships important for triage. It relies on process creation telemetry including the child Image path and the ParentImage path, with additional exclusions for known benign parent locations and Defender-related parents.
references:
- https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2
- https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/
- https://www.13cubed.com/downloads/windows_process_genealogy_v2.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_proc_wrong_parent.yml
author: vburov, Huntrule Team
date: 2019-02-23
modified: 2025-03-06
tags:
- attack.stealth
- attack.t1036.003
- attack.t1036.005
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \svchost.exe
- \taskhost.exe
- \lsm.exe
- \lsass.exe
- \services.exe
- \lsaiso.exe
- \csrss.exe
- \wininit.exe
- \winlogon.exe
filter_sys:
- ParentImage|endswith:
- \SavService.exe
- \ngen.exe
- ParentImage|contains:
- \System32\
- \SysWOW64\
filter_msmpeng:
ParentImage|contains:
- \Windows Defender\
- \Microsoft Security Client\
ParentImage|endswith: \MsMpEng.exe
filter_null:
- ParentImage: null
- ParentImage:
- ""
- "-"
condition: selection and not 1 of filter_*
falsepositives:
- Some security products seem to spawn these
level: low
license: DRL-1.1
related:
- id: 96036718-71cc-4027-a538-d1587e0006a7
type: derived