Windows Process: RazerInstaller Explorer Subprocess with System Integrity Level

title: "Windows Process: RazerInstaller Explorer Subprocess with System Integrity Level"
id: f3e04317-b83a-4c09-914e-a84dd9b89624
status: test
description: This rule identifies explorer.exe child processes spawned by RazerInstaller.exe while the parent runs with high integrity (System or S-1-16-16384). Such behavior matters because an installer-created explorer subprocess can be abused to enable privilege escalation and defense-impairment scenarios. The detection relies on Windows process creation telemetry capturing parent-child relationships, image paths, and integrity level.
references:
  - https://twitter.com/j0nh4t/status/1429049506021138437
  - https://streamable.com/q2dsji
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/RazerInstaller-LPE-Exploit/proc_creation_win_exploit_other_razorinstaller_lpe.yml
author: Florian Roth (Nextron Systems), Maxime Thiebaut, Huntrule Team
date: 2021-08-23
modified: 2024-12-01
tags:
  - attack.privilege-escalation
  - attack.defense-impairment
  - attack.t1553
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \RazerInstaller.exe
    IntegrityLevel:
      - System
      - S-1-16-16384
  filter_main_razer:
    Image|startswith: C:\Windows\Installer\Razer\Installer\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - User selecting a different installation folder (check for other sub processes of this explorer.exe process)
level: high
license: DRL-1.1
related:
  - id: a4eaf250-7dc1-4842-862a-5e71cd59a167
    type: derived