huntrule

Windows Process Creation: Sysinternals PsSuspend Targeting msmpeng.exe

Alerts on execution of Sysinternals PsSuspend with command line referencing msmpeng.exe.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: Sysinternals PsSuspend Targeting msmpeng.exe"
id: e17f1fc1-c3d2-4240-b736-6f33884aa801
related:
  - id: 48bbc537-b652-4b4e-bd1d-281172df448f
    type: similar
  - id: 4beb6ae0-f85b-41e2-8f18-8668abc8af78
    type: derived
status: test
description: This rule flags process creation where the Sysinternals PsSuspend binary (pssuspend.exe variants) is executed with command line text that contains msmpeng.exe. Suspending security-related processes can impair endpoint defenses and is a common tactic for evasion. The detection relies on Windows process creation telemetry, matching the image name and command line contents for psuspend variants and msmpeng.exe.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/pssuspend
  - https://twitter.com/0gtweet/status/1638069413717975046
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_pssuspend_susp_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-23
modified: 2026-06-29
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName: pssuspend.exe
    - Image|endswith:
        - \pssuspend.exe
        - \pssuspend64.exe
        - \pssuspend64a.exe
  selection_cli:
    CommandLine|contains: msmpeng.exe
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule flags process creation where the Sysinternals PsSuspend binary (pssuspend.exe variants) is executed with command line text that contains msmpeng.exe. Suspending security-related processes can impair endpoint defenses and is a common tactic for evasion. The detection relies on Windows process creation telemetry, matching the image name and command line contents for psuspend variants and msmpeng.exe.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.