Windows sdiagnhost.exe Spawns Suspicious Child Process (PowerShell/CMD/MSHTA/etc.)
Alert when sdiagnhost.exe launches high-risk child processes like PowerShell or CMD, excluding selected benign-like command patterns.
- Product
- windows
- Category
- process_creation
- Author
- Nextron Systems, @Kostastsale (SigmaHQ), DRL 1.1
- Published
- 2022-06-01
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where sdiagnhost.exe spawns a child process commonly abused for execution, including PowerShell, CMD, MSHTA, cscript/wscript, taskkill, regsvr32, rundll32, and calc. Such parent-to-child behavior is relevant because attackers can leverage signed Windows binaries to run follow-on commands and reduce detection opportunities. It relies on process creation telemetry capturing the parent Image and child Image/CommandLine, including specific command-line substrings used to reduce matches for certain benign patterns.
Reporting behind it
- twitter.comhttps://twitter.com/nao_sec/status/1530196847679401984
- doublepulsar.comhttps://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
- app.any.runhttps://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
- app.any.runhttps://app.any.run/tasks/f420d295-0457-4e9b-9b9e-6732be227583/
- app.any.runhttps://app.any.run/tasks/c4117d9a-f463-461a-b90f-4cd258746798/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sdiagnhost_susp_child.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows sdiagnhost.exe Spawns Suspicious Child Process (PowerShell/CMD/MSHTA/etc.)
id: d19c8634-5735-4ceb-ad48-c47f20ba9110
status: test
description: This rule flags Windows process creation events where sdiagnhost.exe spawns a child process commonly abused for execution, including PowerShell, CMD, MSHTA, cscript/wscript, taskkill, regsvr32, rundll32, and calc. Such parent-to-child behavior is relevant because attackers can leverage signed Windows binaries to run follow-on commands and reduce detection opportunities. It relies on process creation telemetry capturing the parent Image and child Image/CommandLine, including specific command-line substrings used to reduce matches for certain benign patterns.
references:
- https://twitter.com/nao_sec/status/1530196847679401984
- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
- https://app.any.run/tasks/f420d295-0457-4e9b-9b9e-6732be227583/
- https://app.any.run/tasks/c4117d9a-f463-461a-b90f-4cd258746798/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sdiagnhost_susp_child.yml
author: Nextron Systems, @Kostastsale, Huntrule Team
date: 2022-06-01
modified: 2024-08-23
tags:
- attack.stealth
- attack.t1036
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \sdiagnhost.exe
Image|endswith:
- \powershell.exe
- \pwsh.exe
- \cmd.exe
- \mshta.exe
- \cscript.exe
- \wscript.exe
- \taskkill.exe
- \regsvr32.exe
- \rundll32.exe
- \calc.exe
filter_main_cmd_bits:
Image|endswith: \cmd.exe
CommandLine|contains: bits
filter_main_powershell_noprofile:
Image|endswith: \powershell.exe
CommandLine|endswith:
- -noprofile -
- -noprofile
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: f3d39c45-de1a-4486-a687-ab126124f744
type: derived