Windows Process Creation with taskmgr.exe as Parent Process

Flags process creation where taskmgr.exe is the parent, excluding a few known benign child process images.

FreeUnreviewedSigmalowv1

windows-process-creation-with-taskmgr-exe-as-parent-process-3d7679bd

title: Windows Process Creation with taskmgr.exe as Parent Process
id: c8fbe11c-2a9e-4450-810a-2a7d15a462fe
status: test
description: This rule alerts when a new process is created with taskmgr.exe as the parent process, indicating process spawning from the Windows Task Manager. Attackers can use legitimate Windows binaries and user-context tools to launch payloads while blending in with normal activity. The detection relies on Windows process creation telemetry, specifically parent and image path fields to identify taskmgr.exe as the parent and exclude a small set of common taskmgr-related processes.
references:
  - https://twitter.com/ReneFreingruber/status/1172244989335810049
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_taskmgr_susp_child_process.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-03-13
modified: 2024-01-18
tags:
  - attack.stealth
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \taskmgr.exe
  filter_main_generic:
    Image|endswith:
      - :\Windows\System32\mmc.exe
      - :\Windows\System32\resmon.exe
      - :\Windows\System32\Taskmgr.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Administrative activity
level: low
license: DRL-1.1
related:
  - id: 3d7679bd-0c00-440c-97b0-3f204273e6c7
    type: derived

What it detects

This rule alerts when a new process is created with taskmgr.exe as the parent process, indicating process spawning from the Windows Task Manager. Attackers can use legitimate Windows binaries and user-context tools to launch payloads while blending in with normal activity. The detection relies on Windows process creation telemetry, specifically parent and image path fields to identify taskmgr.exe as the parent and exclude a small set of common taskmgr-related processes.

Known false positives

Administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.