Windows: Suspicious Parent Process Execution From \Users\Public Spawning Scripting/Shell Binaries

title: "Windows: Suspicious Parent Process Execution From \\Users\\Public Spawning Scripting/Shell Binaries"
id: 1355bc0d-8e95-4c22-9ef9-e3b28ce2aab6
status: test
description: This rule flags process creation where a parent executable located under \Users\Public is spawning child processes that match common shell or scripting utilities. Attackers often leverage world-writable public locations to stage or run payloads, then use utilities like PowerShell, cmd, mshta, or certutil for follow-on execution. The detection relies on Windows process creation telemetry fields for ParentImage, child Image, and CommandLine content.
references:
  - https://redcanary.com/blog/blackbyte-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_execution_from_public_folder_as_parent.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-02-25
modified: 2024-07-12
tags:
  - attack.execution
  - attack.stealth
  - attack.t1564
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: :\Users\Public\
  selection_child:
    - Image|endswith:
        - \bitsadmin.exe
        - \certutil.exe
        - \cmd.exe
        - \cscript.exe
        - \mshta.exe
        - \powershell.exe
        - \pwsh.exe
        - \regsvr32.exe
        - \rundll32.exe
        - \wscript.exe
    - CommandLine|contains:
        - bitsadmin
        - certutil
        - cscript
        - mshta
        - powershell
        - regsvr32
        - rundll32
        - wscript
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 69bd9b97-2be2-41b6-9816-fb08757a4d1a
    type: derived