Windows Process Execution of wsudo with System or TrustedInstaller
Alerts on wsudo.exe runs from wsudo-bridge.exe requesting execution as System or TrustedInstaller.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-12-02
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags execution of wsudo.exe when launched via wsudo-bridge.exe and when the command line requests elevated execution as System or TrustedInstaller. Such behavior matters because it can enable running attacker-controlled programs under higher privileges, facilitating privilege escalation. It relies on Windows process creation telemetry, including image filename, parent process, and command-line parameters.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Execution of wsudo with System or TrustedInstaller
id: 29df8f9f-193d-4c62-9546-bfa2f287b536
status: test
description: This rule flags execution of wsudo.exe when launched via wsudo-bridge.exe and when the command line requests elevated execution as System or TrustedInstaller. Such behavior matters because it can enable running attacker-controlled programs under higher privileges, facilitating privilege escalation. It relies on Windows process creation telemetry, including image filename, parent process, and command-line parameters.
references:
- https://github.com/M2Team/Privexec/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_wsudo_susp_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-02
modified: 2023-02-14
tags:
- attack.execution
- attack.privilege-escalation
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_metadata:
- Image|endswith: \wsudo.exe
- OriginalFileName: wsudo.exe
- Description: Windows sudo utility
- ParentImage|endswith: \wsudo-bridge.exe
selection_cli:
CommandLine|contains:
- -u System
- -uSystem
- -u TrustedInstaller
- -uTrustedInstaller
- " --ti "
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: bdeeabc9-ff2a-4a51-be59-bb253aac7891
type: derived