Windows sdiagnhost.exe Spawns Suspicious Child Process (PowerShell/CMD/MSHTA/etc.)

Alert when sdiagnhost.exe launches high-risk child processes like PowerShell or CMD, excluding selected benign-like command patterns.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Nextron Systems, @Kostastsale (SigmaHQ), DRL 1.1
Published: 2022-06-01
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1036Masquerading
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where sdiagnhost.exe spawns a child process commonly abused for execution, including PowerShell, CMD, MSHTA, cscript/wscript, taskkill, regsvr32, rundll32, and calc. Such parent-to-child behavior is relevant because attackers can leverage signed Windows binaries to run follow-on commands and reduce detection opportunities. It relies on process creation telemetry capturing the parent Image and child Image/CommandLine, including specific command-line substrings used to reduce matches for certain benign patterns.

Reporting behind it

Related detections9 linkedT1036 — drag to rearrange

Suspicious Scripting Interpreter Execution From Downloads Or Temp via Reputation Hijacking

Suspicious MMC Console Loading MSC File From User Writable Path

Windows msdt.exe Execution with Suspicious Parent Process

Windows renamed dctask64.exe execution via known IMPHASH values

Suspicious Billbug Loader Artifacts in Windows Temp Directory

Malicious Scheduled Task Masquerading as Windows Defender Sync via schtasks (via process_creation)

Malicious Startup Persistence via WindowsDefenderSync Shortcut (via file_event)

Malicious PXA Stealer Archive Extraction via Renamed WinRAR images.png (via process_creation)

Malicious NimDoor Loader Persistence via Masqueraded Google Updater (via file_event)

Windows sdiagnhost.exe Spawns Suspicious Child Process (PowerShell/CMD/MSHTA/etc.)

Pivot detection · T1036 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-sdiagnhost-exe-spawns-suspicious-child-process-powershell-cmd-mshta-etc-f3d39c45

title: Windows sdiagnhost.exe Spawns Suspicious Child Process (PowerShell/CMD/MSHTA/etc.)
id: d19c8634-5735-4ceb-ad48-c47f20ba9110
status: test
description: This rule flags Windows process creation events where sdiagnhost.exe spawns a child process commonly abused for execution, including PowerShell, CMD, MSHTA, cscript/wscript, taskkill, regsvr32, rundll32, and calc. Such parent-to-child behavior is relevant because attackers can leverage signed Windows binaries to run follow-on commands and reduce detection opportunities. It relies on process creation telemetry capturing the parent Image and child Image/CommandLine, including specific command-line substrings used to reduce matches for certain benign patterns.
references:
  - https://twitter.com/nao_sec/status/1530196847679401984
  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
  - https://app.any.run/tasks/f420d295-0457-4e9b-9b9e-6732be227583/
  - https://app.any.run/tasks/c4117d9a-f463-461a-b90f-4cd258746798/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sdiagnhost_susp_child.yml
author: Nextron Systems, @Kostastsale, Huntrule Team
date: 2022-06-01
modified: 2024-08-23
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \sdiagnhost.exe
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
      - \cmd.exe
      - \mshta.exe
      - \cscript.exe
      - \wscript.exe
      - \taskkill.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \calc.exe
  filter_main_cmd_bits:
    Image|endswith: \cmd.exe
    CommandLine|contains: bits
  filter_main_powershell_noprofile:
    Image|endswith: \powershell.exe
    CommandLine|endswith:
      - -noprofile -
      - -noprofile
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f3d39c45-de1a-4486-a687-ab126124f744
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL