Windows process creation: Service-launched getsystem via cmd/%COMSPEC% named pipes (Meterpreter/CobaltStrike)

Alerts when services.exe spawns cmd/%COMSPEC% commands writing to a named pipe consistent with getsystem behavior.

FreeUnreviewedSigmahighv1

windows-process-creation-service-launched-getsystem-via-cmd-comspec-named-pipes--15619216

title: "Windows process creation: Service-launched getsystem via cmd/%COMSPEC% named pipes (Meterpreter/CobaltStrike)"
id: 24b207b8-fce7-487d-bebe-d5ba250c266e
status: test
description: This rule flags Windows process creation where a child process started from services.exe uses cmd.exe or %COMSPEC% to write data to a named pipe, consistent with Meterpreter/Cobalt Strike "getsystem" techniques. Attackers use this behavior to escalate privileges by executing commands that interact with inter-process communication endpoints. Telemetry required is process creation events with ParentImage and full CommandLine content to match the expected command patterns and exclude known benign interference from MpCmdRun.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
  - https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_meterpreter_getsystem.yml
author: Teymur Kheirkhabarov, Ecco, Florian Roth, Huntrule Team
date: 2019-10-26
modified: 2023-02-05
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1134.001
  - attack.t1134.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    ParentImage|endswith: \services.exe
  selection_technique_1:
    CommandLine|contains|all:
      - /c
      - echo
      - \pipe\
    CommandLine|contains:
      - cmd
      - "%COMSPEC%"
  selection_technique_2:
    CommandLine|contains|all:
      - rundll32
      - .dll,a
      - "/p:"
  filter_defender:
    CommandLine|contains: MpCmdRun
  condition: selection_img and 1 of selection_technique_* and not 1 of filter_*
falsepositives:
  - Commandlines containing components like cmd accidentally
  - Jobs and services started with cmd
level: high
license: DRL-1.1
related:
  - id: 15619216-e993-4721-b590-4c520615a67d
    type: derived

What it detects

This rule flags Windows process creation where a child process started from services.exe uses cmd.exe or %COMSPEC% to write data to a named pipe, consistent with Meterpreter/Cobalt Strike "getsystem" techniques. Attackers use this behavior to escalate privileges by executing commands that interact with inter-process communication endpoints. Telemetry required is process creation events with ParentImage and full CommandLine content to match the expected command patterns and exclude known benign interference from MpCmdRun.

Known false positives

Commandlines containing components like cmd accidentally
Jobs and services started with cmd

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.