Windows Suspicious Parent Processes: Unusual Child Creation by System Utilities

title: "Windows Suspicious Parent Processes: Unusual Child Creation by System Utilities"
id: 1e355b77-0868-42b8-8b17-d669ee0431e7
status: test
description: This rule flags Windows process creation events where the parent process image ends with specific binaries (e.g., minesweeper.exe, winver.exe, bitsadmin.exe, csrss.exe, certutil.exe, eventvwr.exe, calc.exe, notepad.exe). These parent processes are expected to have limited, normal child behavior; attackers may use them to blend into user/system activity. It relies on process creation telemetry including parent and child image paths, plus exclusions for known benign child executables and null image values.
references:
  - https://twitter.com/x86matthew/status/1505476263464607744?s=12
  - https://svch0st.medium.com/stats-from-hunting-cobalt-strike-beacons-c17e56255f9b
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_parents.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-21
modified: 2022-09-08
tags:
  - attack.stealth
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \minesweeper.exe
      - \winver.exe
      - \bitsadmin.exe
  selection_special:
    ParentImage|endswith:
      - \csrss.exe
      - \certutil.exe
      - \eventvwr.exe
      - \calc.exe
      - \notepad.exe
  filter_special:
    Image|endswith:
      - \WerFault.exe
      - \wermgr.exe
      - \conhost.exe
      - \mmc.exe
      - \win32calc.exe
      - \notepad.exe
  filter_null:
    Image: null
  condition: selection or ( selection_special and not 1 of filter_* )
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: cbec226f-63d9-4eca-9f52-dfb6652f24df
    type: derived