Windows SpeechRuntime.exe Child Process Creation

ATT&CK techniques

Defense Evasion → Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
- T1021.003Distributed Component Object Model
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where the parent process image ends with \SpeechRuntime.exe, capturing potentially suspicious activity driven by the Speech Runtime. Attackers may abuse a legitimate binary to spawn additional processes as part of lateral movement techniques. The detection relies on Windows process creation telemetry that includes the parent image path and child process start events.

Reporting behind it

Related detections9 linkedT1218 — drag to rearrange

Windows: Detect Suspicious DLL Loads by BaaUpdate.exe from Publicly Writable Paths

Windows: Detect baaupdate.exe Spawning Scripting, Admin, or LOLBin Child Processes

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

Malicious DLL Execution via Wuauclt Update Handler (via process_creation)

Malicious Impacket DCOMexec Process Abuse via MMC (via process_creation)

Malicious Impacket DCOMexec Privilege Abuse via MMC (via security)

Malicious aspnet_compiler.exe Injection Host Spawned by PowerShell via process_creation

Malicious regsvcs LOLBin Loading Ransomware DLL from UNC Path

Suspicious RegAsm or RegSvcs Spawned by Script Host (via process_creation)

Windows SpeechRuntime.exe Child Process Creation

Pivot detection · T1218 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-speechruntime-exe-child-process-creation-78f10490

title: Windows SpeechRuntime.exe Child Process Creation
id: cbf5dc38-c820-42ab-a2b3-dc1535d38698
status: experimental
description: This rule flags process creation events where the parent process image ends with \SpeechRuntime.exe, capturing potentially suspicious activity driven by the Speech Runtime. Attackers may abuse a legitimate binary to spawn additional processes as part of lateral movement techniques. The detection relies on Windows process creation telemetry that includes the parent image path and child process start events.
references:
  - https://github.com/rtecCyberSec/SpeechRuntimeMove
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_speechruntime_child_process.yml
author: andrewdanis, Huntrule Team
date: 2025-10-23
logsource:
  category: process_creation
  product: windows
tags:
  - attack.lateral-movement
  - attack.stealth
  - attack.t1021.003
  - attack.t1218
detection:
  selection:
    ParentImage|endswith: \SpeechRuntime.exe
  condition: selection
falsepositives:
  - Unlikely.
level: high
license: DRL-1.1
related:
  - id: 78f10490-f2f4-4d19-a75b-4e0683bf3b8d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL