Windows Process Execution of wsudo with System or TrustedInstaller

Alerts on wsudo.exe runs from wsudo-bridge.exe requesting execution as System or TrustedInstaller.

FreeUnreviewedSigmahighv1

windows-process-execution-of-wsudo-with-system-or-trustedinstaller-bdeeabc9

title: Windows Process Execution of wsudo with System or TrustedInstaller
id: 29df8f9f-193d-4c62-9546-bfa2f287b536
status: test
description: This rule flags execution of wsudo.exe when launched via wsudo-bridge.exe and when the command line requests elevated execution as System or TrustedInstaller. Such behavior matters because it can enable running attacker-controlled programs under higher privileges, facilitating privilege escalation. It relies on Windows process creation telemetry, including image filename, parent process, and command-line parameters.
references:
  - https://github.com/M2Team/Privexec/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_wsudo_susp_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-02
modified: 2023-02-14
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_metadata:
    - Image|endswith: \wsudo.exe
    - OriginalFileName: wsudo.exe
    - Description: Windows sudo utility
    - ParentImage|endswith: \wsudo-bridge.exe
  selection_cli:
    CommandLine|contains:
      - -u System
      - -uSystem
      - -u TrustedInstaller
      - -uTrustedInstaller
      - " --ti "
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: bdeeabc9-ff2a-4a51-be59-bb253aac7891
    type: derived

What it detects

This rule flags execution of wsudo.exe when launched via wsudo-bridge.exe and when the command line requests elevated execution as System or TrustedInstaller. Such behavior matters because it can enable running attacker-controlled programs under higher privileges, facilitating privilege escalation. It relies on Windows process creation telemetry, including image filename, parent process, and command-line parameters.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.