Windows sdclt.exe Child Process Creation

Alerts when sdclt.exe launches a child process, a behavior consistent with abused Windows binaries in escalation chains.

FreeUnreviewedSigmamediumv1

windows-sdclt-exe-child-process-creation-da2738f2

title: Windows sdclt.exe Child Process Creation
id: f8f039e7-f728-4c9a-94b1-4209872c026c
status: test
description: This rule flags process creation events where the parent process is sdclt.exe. Attackers may abuse sdclt.exe to spawn additional processes as part of privilege escalation workflows or to execute actions under the context of a trusted Windows binary. The detection relies on Windows process creation telemetry that includes the parent process image path.
references:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/6
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sdclt_child_process.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-05-02
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \sdclt.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: da2738f2-fadb-4394-afa7-0a0674885afa
    type: derived

What it detects

This rule flags process creation events where the parent process is sdclt.exe. Attackers may abuse sdclt.exe to spawn additional processes as part of privilege escalation workflows or to execute actions under the context of a trusted Windows binary. The detection relies on Windows process creation telemetry that includes the parent process image path.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.