Windows Sysmon Process Creation Where Sysmon Spawned a Child Process

title: Windows Sysmon Process Creation Where Sysmon Spawned a Child Process
id: 03ef263c-bdca-4d0e-81d7-050cc44911d2
status: test
description: This rule flags Windows process creation events where the parent process image ends with Sysmon.exe or Sysmon64.exe. An attacker may abuse a trusted system utility or misused execution path to launch additional processes from within Sysmon’s context. The detection relies on process creation telemetry that includes both the parent image path and the new process image path to match the specified parent naming and apply path exclusions.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41120
  - https://twitter.com/filip_dragovic/status/1590052248260055041
  - https://twitter.com/filip_dragovic/status/1590104354727436290
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-41120/proc_creation_win_exploit_cve_2022_41120_sysmon_eop.yml
author: Florian Roth (Nextron Systems), Tim Shelton (fp werfault), Huntrule Team
date: 2022-11-10
modified: 2025-07-04
tags:
  - attack.privilege-escalation
  - attack.t1068
  - cve.2022-41120
  - detection.emerging-threats
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith:
      - \Sysmon.exe
      - \Sysmon64.exe
  filter_main_temp_sysmon:
    Image|startswith: C:\Users\
    Image|contains: \AppData\Local\Temp\
    Image|endswith:
      - \Sysmon.exe
      - \Sysmon64.exe
  filter_main_generic:
    Image|contains:
      - :\Windows\Sysmon.exe
      - :\Windows\Sysmon64.exe
      - :\Windows\System32\conhost.exe
      - :\Windows\System32\WerFault.exe
      - :\Windows\System32\WerFaultSecure.exe
      - :\Windows\System32\wevtutil.exe
      - :\Windows\SysWOW64\wevtutil.exe
  filter_main_null:
    Image: null
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 6d1058a4-407e-4f3a-a144-1968c11dc5c3
    type: derived