huntrule

Windows Process Creation: Suspicious splwow64.exe Missing Command-Line Parameters

Flags Windows executions of splwow64.exe where the command line ends at the executable with no parameters.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-08-23
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

Identifies instances where splwow64.exe is created without command-line arguments, based on the process image ending with \splwow64.exe and the command line ending with splwow64.exe. This matters because attackers may abuse Windows installed binaries to run stealthy execution paths that omit expected parameters. The rule relies on process creation telemetry containing both the executable path and the command line text.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange
Windows SFTP.exe Indirect Command Execution via ProxyCommand
WSL Process Execution of Kali Linux on Windows
Windows vshadow.exe Proxy Execution via -exec Script/Command
Windows ConHost Spawning Suspicious Script and Command-Line Child Processes
Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName
Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line
Windows Process Creation: Execution of Renamed curl.exe via PE Metadata
Suspicious Child Process Creation from BgInfo.EXE on Windows
Windows Bash.exe Launched Without Script Execution Arguments
Windows Process Creation: Suspicious splwow64.exe Missing Command-Line Parameters
Pivot detection · T1202 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.