Windows Process Creation by ANONYMOUS User with System32/AppData Parent Image

title: Windows Process Creation by ANONYMOUS User with System32/AppData Parent Image
id: 89449b58-b4d7-4a1a-aed7-e910cd08a833
status: test
description: This rule flags Windows process creation events where the parent image path contains either \Windows\System32\ or \AppData\, and the process is associated with a user value containing "ANONYMOUS". Attackers may use atypical or placeholder user contexts to obscure activity and make process lineage harder to interpret. The detection relies on process creation telemetry that includes parent image path and the user field tied to the new process.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/COLDSTEEL/proc_creation_win_malware_coldsteel_anonymous_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-30
tags:
  - attack.persistence
  - detection.emerging-threats
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - \Windows\System32\
      - \AppData\
    User|contains: ANONYMOUS
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e01b6eb5-1eb4-4465-a165-85d40d874add
    type: derived