Windows Process Creation: Suspicious Child Processes Spawned by eventvwr.exe

Alerts when eventvwr.exe spawns unusual child processes in Windows process creation logs.

FreeUnreviewedSigmahighv1

windows-process-creation-suspicious-child-processes-spawned-by-eventvwr-exe-be344333

title: "Windows Process Creation: Suspicious Child Processes Spawned by eventvwr.exe"
id: 1e123aef-b49d-4b83-ad14-36aa39e35d8a
related:
  - id: 7c81fec3-1c1d-43b0-996a-46753041b1b6
    type: derived
  - id: be344333-921d-4c4d-8bb8-e584cf584780
    type: derived
status: test
description: This rule flags uncommon or suspicious child process executions where the parent process is eventvwr.exe, based on the parent image ending with \eventvwr.exe. Such activity can indicate attempts to leverage the Windows Event Viewer as part of privilege-escalation techniques. The detection relies on Windows process creation telemetry, using parent image matching to identify the initiating process and excluding a small set of known benign child process paths.
references:
  - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
  - https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_eventvwr_susp_child_process.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-19
modified: 2023-09-28
tags:
  - attack.privilege-escalation
  - attack.t1548.002
  - car.2019-04-001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \eventvwr.exe
  filter_main_generic:
    Image|endswith:
      - :\Windows\System32\mmc.exe
      - :\Windows\System32\WerFault.exe
      - :\Windows\SysWOW64\WerFault.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags uncommon or suspicious child process executions where the parent process is eventvwr.exe, based on the parent image ending with \eventvwr.exe. Such activity can indicate attempts to leverage the Windows Event Viewer as part of privilege-escalation techniques. The detection relies on Windows process creation telemetry, using parent image matching to identify the initiating process and excluding a small set of known benign child process paths.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.