Windows Process Creation: taskmgr.exe launched in LOCAL_SYSTEM context

Flags taskmgr.exe process creation when initiated under a LOCAL_SYSTEM-equivalent user context string.

FreeUnreviewedSigmahighv1

windows-process-creation-taskmgr-exe-launched-in-local-system-context-9fff585c

title: "Windows Process Creation: taskmgr.exe launched in LOCAL_SYSTEM context"
id: a783524c-1639-46ba-99b1-c36d0b61e991
status: test
description: This rule matches process creation events where an executable ending with \taskmgr.exe is launched by a security context containing the string "AUTHORI" or "AUTORI" (to cover multiple Windows language settings), indicating LOCAL_SYSTEM. Attackers may abuse signed system utilities like Task Manager to blend into normal administrative activity or to execute stealthy payloads. The detection relies on Windows process creation telemetry, including the process image path and the initiating user/security-context field.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_taskmgr_localsystem.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-03-18
modified: 2022-05-27
tags:
  - attack.stealth
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    User|contains:
      - AUTHORI
      - AUTORI
    Image|endswith: \taskmgr.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9fff585c-c33e-4a86-b3cd-39312079a65f
    type: derived

What it detects

This rule matches process creation events where an executable ending with \taskmgr.exe is launched by a security context containing the string "AUTHORI" or "AUTORI" (to cover multiple Windows language settings), indicating LOCAL_SYSTEM. Attackers may abuse signed system utilities like Task Manager to blend into normal administrative activity or to execute stealthy payloads. The detection relies on Windows process creation telemetry, including the process image path and the initiating user/security-context field.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.