Windows SpeechRuntime.exe Child Process Creation

Alerts when SpeechRuntime.exe spawns a child process, highlighting potential abuse for lateral movement on Windows.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: andrewdanis (SigmaHQ), DRL 1.1
Published: 2025-10-23
Updated: 2026-07-30

ATT&CK techniques

Defense Evasion → Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
- T1021.003Distributed Component Object Model
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where the parent process image ends with \SpeechRuntime.exe, capturing potentially suspicious activity driven by the Speech Runtime. Attackers may abuse a legitimate binary to spawn additional processes as part of lateral movement techniques. The detection relies on Windows process creation telemetry that includes the parent image path and child process start events.

Reporting behind it

Related detections9 linkedT1218 — drag to rearrange

Windows: Detect Suspicious DLL Loads by BaaUpdate.exe from Publicly Writable Paths

Windows: Detect baaupdate.exe Spawning Scripting, Admin, or LOLBin Child Processes

Suspicious .NET LOLBin Execution via CasPol or RegAsm

Possible DarkGate DLL Sideloading via iTunesHelper Loading CoreFoundation

Suspicious extrac32 CAB Extraction Abuse

Malicious cdb.exe Masquerading as fontdrvhost in ProgramData (via process_creation)

Malicious certutil Decodehex Payload Reconstruction by DarkGate

Malicious MSIX Package Execution via App Installer ms-appinstaller Protocol (via process_creation)

Suspicious Child Process Spawned by Control Panel DCOM Surrogate

Windows SpeechRuntime.exe Child Process Creation

Pivot detection · T1218 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-speechruntime-exe-child-process-creation-78f10490

title: Windows SpeechRuntime.exe Child Process Creation
id: cbf5dc38-c820-42ab-a2b3-dc1535d38698
status: experimental
description: This rule flags process creation events where the parent process image ends with \SpeechRuntime.exe, capturing potentially suspicious activity driven by the Speech Runtime. Attackers may abuse a legitimate binary to spawn additional processes as part of lateral movement techniques. The detection relies on Windows process creation telemetry that includes the parent image path and child process start events.
references:
  - https://github.com/rtecCyberSec/SpeechRuntimeMove
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_speechruntime_child_process.yml
author: andrewdanis, Huntrule Team
date: 2025-10-23
logsource:
  category: process_creation
  product: windows
tags:
  - attack.lateral-movement
  - attack.stealth
  - attack.t1021.003
  - attack.t1218
detection:
  selection:
    ParentImage|endswith: \SpeechRuntime.exe
  condition: selection
falsepositives:
  - Unlikely.
level: high
license: DRL-1.1
related:
  - id: 78f10490-f2f4-4d19-a75b-4e0683bf3b8d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL