huntrule

Windows Sysinternals PsSuspend Process Execution

Alerts on execution of Sysinternals PsSuspend on Windows via process creation events.

FreeUnreviewedSigmamediumv1
title: Windows Sysinternals PsSuspend Process Execution
id: e2aa611b-c018-412f-bc25-253db6dad545
related:
  - id: 4beb6ae0-f85b-41e2-8f18-8668abc8af78
    type: similar
  - id: 48bbc537-b652-4b4e-bd1d-281172df448f
    type: derived
status: test
description: This rule flags process creation events where an executed binary is Sysinternals PsSuspend (pssuspend.exe, pssuspend64.exe, or pssuspend64a.exe). Suspending processes can disrupt normal system operation and may be used as part of persistence or other attacker workflows. Detection relies on Windows process creation telemetry identifying the executable via OriginalFileName and file path/filename suffixes.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/pssuspend
  - https://twitter.com/0gtweet/status/1638069413717975046
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_pssuspend_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-23
modified: 2026-06-29
tags:
  - attack.privilege-escalation
  - attack.discovery
  - attack.persistence
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - OriginalFileName: pssuspend.exe
    - Image|endswith:
        - \pssuspend.exe
        - \pssuspend64.exe
        - \pssuspend64a.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags process creation events where an executed binary is Sysinternals PsSuspend (pssuspend.exe, pssuspend64.exe, or pssuspend64a.exe). Suspending processes can disrupt normal system operation and may be used as part of persistence or other attacker workflows. Detection relies on Windows process creation telemetry identifying the executable via OriginalFileName and file path/filename suffixes.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.