Windows Process Creation Using the Sysnative Directory Path

title: Windows Process Creation Using the Sysnative Directory Path
id: 8e64ccb0-9b0f-4e18-b41d-211fd0bfdd91
status: test
description: This rule flags Windows process creation events where the process command line or image path contains the \Windows\Sysnative directory. Attackers can use Sysnative to access the native 64-bit system path from a 32-bit context, helping with evasion and stealth. It relies on process creation telemetry, matching the Image and CommandLine fields for the Sysnative path while excluding likely benign .NET ngen.exe activity and a specific XAMPP startup pattern.
references:
  - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_sysnative.yml
author: Max Altgelt (Nextron Systems), Huntrule Team
date: 2022-08-23
modified: 2025-10-08
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|contains: :\Windows\Sysnative\
    - Image|contains: :\Windows\Sysnative\
  filter_main_ngen:
    Image|contains:
      - C:\Windows\Microsoft.NET\Framework64\v
      - C:\Windows\Microsoft.NET\Framework\v
      - C:\Windows\Microsoft.NET\FrameworkArm\v
      - C:\Windows\Microsoft.NET\FrameworkArm64\v
    Image|endswith: \ngen.exe
    CommandLine|contains: install
  filter_optional_xampp:
    CommandLine|contains|all:
      - '"C:\Windows\sysnative\cmd.exe"'
      - \xampp\
      - \catalina_start.bat
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 3c1b5fb0-c72f-45ba-abd1-4d4c353144ab
    type: derived