Windows: Suspicious Parent Process Execution From \Users\Public Spawning Scripting/Shell Binaries
Alerts on processes launched from \Users\Public that execute common scripting/shell binaries or command-line markers.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-02-25
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where a parent executable located under \Users\Public is spawning child processes that match common shell or scripting utilities. Attackers often leverage world-writable public locations to stage or run payloads, then use utilities like PowerShell, cmd, mshta, or certutil for follow-on execution. The detection relies on Windows process creation telemetry fields for ParentImage, child Image, and CommandLine content.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Suspicious Parent Process Execution From \\Users\\Public Spawning Scripting/Shell Binaries"
id: 1355bc0d-8e95-4c22-9ef9-e3b28ce2aab6
status: test
description: This rule flags process creation where a parent executable located under \Users\Public is spawning child processes that match common shell or scripting utilities. Attackers often leverage world-writable public locations to stage or run payloads, then use utilities like PowerShell, cmd, mshta, or certutil for follow-on execution. The detection relies on Windows process creation telemetry fields for ParentImage, child Image, and CommandLine content.
references:
- https://redcanary.com/blog/blackbyte-ransomware/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_execution_from_public_folder_as_parent.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-02-25
modified: 2024-07-12
tags:
- attack.execution
- attack.stealth
- attack.t1564
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: :\Users\Public\
selection_child:
- Image|endswith:
- \bitsadmin.exe
- \certutil.exe
- \cmd.exe
- \cscript.exe
- \mshta.exe
- \powershell.exe
- \pwsh.exe
- \regsvr32.exe
- \rundll32.exe
- \wscript.exe
- CommandLine|contains:
- bitsadmin
- certutil
- cscript
- mshta
- powershell
- regsvr32
- rundll32
- wscript
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 69bd9b97-2be2-41b6-9816-fb08757a4d1a
type: derived