Windows System Privileged Shell Spawn via Elevated Logon (PowerShell/CMD)

Flags creation of privileged PowerShell or cmd.exe processes tied to an elevated logon context.

FreeUnreviewedSigmamediumv1

windows-system-privileged-shell-spawn-via-elevated-logon-powershell-cmd-61065c72

title: Windows System Privileged Shell Spawn via Elevated Logon (PowerShell/CMD)
id: b8b60f6b-115a-46c4-8808-68fe257e210a
related:
  - id: 178e615d-e666-498b-9630-9ed363038101
    type: similar
  - id: 61065c72-5d7d-44ef-bf41-6a36684b545f
    type: derived
status: test
description: This rule identifies process creation events where a shell executable (PowerShell variants or cmd.exe) is launched with a specific elevated logon context. Such activity matters because attackers frequently use a privileged shell to execute follow-on commands and maintain control. The detection relies on Windows process creation telemetry, matching shell executable names and an elevated LogonId value associated with the event.
references:
  - https://github.com/Wh04m1001/SysmonEoP
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_elevated_system_shell.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2023-11-23
modified: 2025-03-06
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.t1059
  - detection.threat-hunting
logsource:
  product: windows
  category: process_creation
detection:
  selection_shell:
    - Image|endswith:
        - \powershell.exe
        - \powershell_ise.exe
        - \pwsh.exe
        - \cmd.exe
    - OriginalFileName:
        - PowerShell.EXE
        - powershell_ise.EXE
        - pwsh.dll
        - Cmd.Exe
  selection_user:
    User|contains:
      - AUTHORI
      - AUTORI
    LogonId: "0x3e7"
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule identifies process creation events where a shell executable (PowerShell variants or cmd.exe) is launched with a specific elevated logon context. Such activity matters because attackers frequently use a privileged shell to execute follow-on commands and maintain control. The detection relies on Windows process creation telemetry, matching shell executable names and an elevated LogonId value associated with the event.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.