Windows Process Creation: Suspicious splwow64.exe Missing Command-Line Parameters

title: "Windows Process Creation: Suspicious splwow64.exe Missing Command-Line Parameters"
id: 046fc301-5d53-4cc3-bd58-1f362a85359f
status: test
description: Identifies instances where splwow64.exe is created without command-line arguments, based on the process image ending with \splwow64.exe and the command line ending with splwow64.exe. This matters because attackers may abuse Windows installed binaries to run stealthy execution paths that omit expected parameters. The rule relies on process creation telemetry containing both the executable path and the command line text.
references:
  - https://twitter.com/sbousseaden/status/1429401053229891590?s=12
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_splwow64_cli_anomaly.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-08-23
modified: 2022-12-25
tags:
  - attack.stealth
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \splwow64.exe
    CommandLine|endswith: splwow64.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1f1a8509-2cbb-44f5-8751-8e1571518ce2
    type: derived