Windows SpeechRuntime.exe Child Process Creation

Alerts when SpeechRuntime.exe spawns a child process, highlighting potential abuse for lateral movement on Windows.

FreeUnreviewedSigmahighv1

windows-speechruntime-exe-child-process-creation-78f10490

title: Windows SpeechRuntime.exe Child Process Creation
id: cbf5dc38-c820-42ab-a2b3-dc1535d38698
status: experimental
description: This rule flags process creation events where the parent process image ends with \SpeechRuntime.exe, capturing potentially suspicious activity driven by the Speech Runtime. Attackers may abuse a legitimate binary to spawn additional processes as part of lateral movement techniques. The detection relies on Windows process creation telemetry that includes the parent image path and child process start events.
references:
  - https://github.com/rtecCyberSec/SpeechRuntimeMove
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_speechruntime_child_process.yml
author: andrewdanis, Huntrule Team
date: 2025-10-23
logsource:
  category: process_creation
  product: windows
tags:
  - attack.lateral-movement
  - attack.stealth
  - attack.t1021.003
  - attack.t1218
detection:
  selection:
    ParentImage|endswith: \SpeechRuntime.exe
  condition: selection
falsepositives:
  - Unlikely.
level: high
license: DRL-1.1
related:
  - id: 78f10490-f2f4-4d19-a75b-4e0683bf3b8d
    type: derived

What it detects

This rule flags process creation events where the parent process image ends with \SpeechRuntime.exe, capturing potentially suspicious activity driven by the Speech Runtime. Attackers may abuse a legitimate binary to spawn additional processes as part of lateral movement techniques. The detection relies on Windows process creation telemetry that includes the parent image path and child process start events.

Known false positives

Unlikely.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.