Windows Process Creation: Crassus Privilege Escalation Discovery Tool Execution
Identifies execution of the Crassus Windows privilege escalation discovery tool via process metadata.
- Product
- windows
- Category
- process_creation
- Author
- pH-T (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-17
- Updated
- 2026-07-30
ATT&CK techniques
ReconResource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where the executable path ends with Crassus.exe, the original file name is Crassus.exe, or the process description contains the string "Crassus". Crassus is used to discover Windows privilege escalation opportunities, which can precede further exploitation. The detection relies on process creation telemetry that includes image path, OriginalFileName, and Description metadata from Windows.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Crassus Privilege Escalation Discovery Tool Execution"
id: ec6a081f-cd61-4090-9474-4a05bbefcacb
status: test
description: This rule flags process creation events where the executable path ends with Crassus.exe, the original file name is Crassus.exe, or the process description contains the string "Crassus". Crassus is used to discover Windows privilege escalation opportunities, which can precede further exploitation. The detection relies on process creation telemetry that includes image path, OriginalFileName, and Description metadata from Windows.
references:
- https://github.com/vu-ls/Crassus
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_crassus.yml
author: pH-T (Nextron Systems), Huntrule Team
date: 2023-04-17
tags:
- attack.discovery
- attack.reconnaissance
- attack.t1590.001
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \Crassus.exe
- OriginalFileName: Crassus.exe
- Description|contains: Crassus
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 2c32b543-1058-4808-91c6-5b31b8bed6c5
type: derived