Windows sdiagnhost.exe Spawns Suspicious Child Process (PowerShell/CMD/MSHTA/etc.)

Alert when sdiagnhost.exe launches high-risk child processes like PowerShell or CMD, excluding selected benign-like command patterns.

FreeUnreviewedSigmahighv1

windows-sdiagnhost-exe-spawns-suspicious-child-process-powershell-cmd-mshta-etc-f3d39c45

title: Windows sdiagnhost.exe Spawns Suspicious Child Process (PowerShell/CMD/MSHTA/etc.)
id: d19c8634-5735-4ceb-ad48-c47f20ba9110
status: test
description: This rule flags Windows process creation events where sdiagnhost.exe spawns a child process commonly abused for execution, including PowerShell, CMD, MSHTA, cscript/wscript, taskkill, regsvr32, rundll32, and calc. Such parent-to-child behavior is relevant because attackers can leverage signed Windows binaries to run follow-on commands and reduce detection opportunities. It relies on process creation telemetry capturing the parent Image and child Image/CommandLine, including specific command-line substrings used to reduce matches for certain benign patterns.
references:
  - https://twitter.com/nao_sec/status/1530196847679401984
  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
  - https://app.any.run/tasks/f420d295-0457-4e9b-9b9e-6732be227583/
  - https://app.any.run/tasks/c4117d9a-f463-461a-b90f-4cd258746798/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sdiagnhost_susp_child.yml
author: Nextron Systems, @Kostastsale, Huntrule Team
date: 2022-06-01
modified: 2024-08-23
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \sdiagnhost.exe
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
      - \cmd.exe
      - \mshta.exe
      - \cscript.exe
      - \wscript.exe
      - \taskkill.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \calc.exe
  filter_main_cmd_bits:
    Image|endswith: \cmd.exe
    CommandLine|contains: bits
  filter_main_powershell_noprofile:
    Image|endswith: \powershell.exe
    CommandLine|endswith:
      - -noprofile -
      - -noprofile
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f3d39c45-de1a-4486-a687-ab126124f744
    type: derived

What it detects

This rule flags Windows process creation events where sdiagnhost.exe spawns a child process commonly abused for execution, including PowerShell, CMD, MSHTA, cscript/wscript, taskkill, regsvr32, rundll32, and calc. Such parent-to-child behavior is relevant because attackers can leverage signed Windows binaries to run follow-on commands and reduce detection opportunities. It relies on process creation telemetry capturing the parent Image and child Image/CommandLine, including specific command-line substrings used to reduce matches for certain benign patterns.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.