Windows getsystem via Meterpreter/Cobalt Strike when services.exe starts a likely privilege escalation command

Alerts when services.exe spawns cmd/%COMSPEC% commands writing to a named pipe consistent with getsystem behavior.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Teymur Kheirkhabarov, Ecco, Florian Roth (SigmaHQ), DRL 1.1
Published: 2019-10-26
Updated: 2026-07-31

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1134.001Token Impersonation/Theft
- T1134.002Create Process with Token
Defense Evasion
- T1134.001Token Impersonation/Theft
- T1134.002Create Process with Token
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation where the parent process is services.exe and the child command line matches known getsystem execution patterns associated with Meterpreter or Cobalt Strike. The behavior matters because obtaining SYSTEM-level privileges is a common step in post-exploitation and enables further stealthy actions. It relies on process creation telemetry, including ParentImage and CommandLine content, and excludes cases containing MpCmdRun to reduce overlap with Microsoft Defender activity.

Reporting behind it

Related detections9 linkedT1134.001 — drag to rearrange

Suspicious Command Shell Spawned by lmadmin License Manager via process_creation

Suspicious Potato Privilege Escalation Tool Execution via process_creation

Suspicious W32TIME Named Pipe Activity Linked to RPC Privilege Escalation (via pipe_created)

Possible Token Manipulation via NewCredentials Logon Type 9

Suspicious Access To Chrome Elevation Service COM Object via Katz Stealer

Malicious Potato Family Privilege Escalation Tool Execution (via process_creation)

Masquerading Cobalt Strike GetSystem Named-Pipe Impersonation Pattern (via process_creation)

Malicious Named Pipe kesknq for Token Impersonation (via pipe_created)

SharpDPAPI Tool Execution via Command-Line and PE Metadata on Windows

Windows getsystem via Meterpreter/Cobalt Strike when services.exe starts a likely privilege escalation command

Pivot detection · T1134.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-service-launched-getsystem-via-cmd-comspec-named-pipes--15619216

title: Windows getsystem via Meterpreter/Cobalt Strike when services.exe starts a likely privilege escalation command
id: 24b207b8-fce7-487d-bebe-d5ba250c266e
status: test
description: This rule flags Windows process creation where the parent process is services.exe and the child command line matches known getsystem execution patterns associated with Meterpreter or Cobalt Strike. The behavior matters because obtaining SYSTEM-level privileges is a common step in post-exploitation and enables further stealthy actions. It relies on process creation telemetry, including ParentImage and CommandLine content, and excludes cases containing MpCmdRun to reduce overlap with Microsoft Defender activity.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
  - https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_meterpreter_getsystem.yml
author: Teymur Kheirkhabarov, Ecco, Florian Roth, Huntrule Team
date: 2019-10-26
modified: 2023-02-05
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1134.001
  - attack.t1134.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    ParentImage|endswith: \services.exe
  selection_technique_1:
    CommandLine|contains|all:
      - /c
      - echo
      - \pipe\
    CommandLine|contains:
      - cmd
      - "%COMSPEC%"
  selection_technique_2:
    CommandLine|contains|all:
      - rundll32
      - .dll,a
      - "/p:"
  filter_defender:
    CommandLine|contains: MpCmdRun
  condition: selection_img and 1 of selection_technique_* and not 1 of filter_*
falsepositives:
  - Commandlines containing components like cmd accidentally
  - Jobs and services started with cmd
level: high
license: DRL-1.1
related:
  - id: 15619216-e993-4721-b590-4c520615a67d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL