Windows Process Creation: Self-Launching Executable Running as Sacrificial Process

Alerts on Windows process creation where a targeted parent context suggests an executable spawns an identical instance, potentially as a sacrificial process.

FreeUnreviewedSigmalowv1

windows-process-creation-self-launching-executable-running-as-sacrificial-proces-bafd07c6

title: "Windows Process Creation: Self-Launching Executable Running as Sacrificial Process"
id: 73ff65bf-ef3b-40a3-9e27-04d68d7a7c53
status: experimental
description: This rule flags cases where a process creation event indicates the parent process Image matches a targeted set, while excluding common benign installer and product contexts. Attackers may use an identical self-spawn to create a temporary or sacrificial process that can support stealthier execution, including possible process injection workflows. Telemetry relies on Windows process creation fields such as ParentImage, OriginalFileName, and Product attribution to separate likely malicious self-launch patterns from legitimate software updaters or installers. Investigate process ancestry and related behaviors (e.g., suspicious argument patterns, parent termination timing, and any process memory manipulation indicators) to determine intent.
references:
  - https://www.joesandbox.com/analysis/1605063/0/html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_parent_execute_itself.yml
author: frack113, Huntrule Team
date: 2025-10-17
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|fieldref: ParentImage
  filter_main_path:
    Image|startswith:
      - C:\Program Files\
      - C:\Program Files (x86)\
  filter_main_original_fn:
    OriginalFileName:
      - Cmd.Exe
      - CompatTelRunner.exe
      - Discord.exe
      - electron.exe
      - EXPLORER.EXE
      - httpd.exe
      - IE4UINIT.EXE
      - mmc.exe
      - MpCmdRun.exe
      - mscorsvw.exe
      - msiexec.exe
      - NGenTask.exe
      - OneDriveSetup.exe
      - PowerShell.EXE
      - REGSVR32.EXE
      - smss.exe
      - Spotify.exe
      - WerMgr
  filter_main_product:
    Product:
      - Avira
      - Evernote
      - Firefox
      - Microsoft Office
      - Ninite
      - Opera Browser Assistant Installer
      - Opera Installer
      - Sysinternals Sysmon
  condition: selection and not 1 of filter_*
falsepositives:
  - Legitimate software that may launch a new instance of itself, especially updaters or installers. Investigate each alert and apply whitelisting as needed.
level: low
license: DRL-1.1
related:
  - id: bafd07c6-3ea5-454a-b4be-058fbb073de7
    type: derived

What it detects

This rule flags cases where a process creation event indicates the parent process Image matches a targeted set, while excluding common benign installer and product contexts. Attackers may use an identical self-spawn to create a temporary or sacrificial process that can support stealthier execution, including possible process injection workflows. Telemetry relies on Windows process creation fields such as ParentImage, OriginalFileName, and Product attribution to separate likely malicious self-launch patterns from legitimate software updaters or installers. Investigate process ancestry and related behaviors (e.g., suspicious argument patterns, parent termination timing, and any process memory manipulation indicators) to determine intent.

Known false positives

Legitimate software that may launch a new instance of itself, especially updaters or installers. Investigate each alert and apply whitelisting as needed.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.