Windows Elevated Shell Spawn via Process Creation (PowerShell or CMD)
Flags creation of privileged PowerShell or cmd.exe processes tied to an elevated logon context.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
- Published
- 2023-11-23
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where a shell binary (PowerShell, PowerShell ISE, pwsh, or cmd) starts with elevated privileges. Elevated shells are a common step in privilege escalation because they enable attackers to run subsequent commands as more-privileged users. The detection relies on Windows process creation telemetry including the image path, original file name, and matching elevated-user indicators via the specific user substring and LogonId.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Elevated Shell Spawn via Process Creation (PowerShell or CMD)
id: b8b60f6b-115a-46c4-8808-68fe257e210a
related:
- id: 178e615d-e666-498b-9630-9ed363038101
type: similar
- id: 61065c72-5d7d-44ef-bf41-6a36684b545f
type: derived
status: test
description: This rule flags process creation events where a shell binary (PowerShell, PowerShell ISE, pwsh, or cmd) starts with elevated privileges. Elevated shells are a common step in privilege escalation because they enable attackers to run subsequent commands as more-privileged users. The detection relies on Windows process creation telemetry including the image path, original file name, and matching elevated-user indicators via the specific user substring and LogonId.
references:
- https://github.com/Wh04m1001/SysmonEoP
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_elevated_system_shell.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2023-11-23
modified: 2025-03-06
tags:
- attack.privilege-escalation
- attack.execution
- attack.t1059
- detection.threat-hunting
logsource:
product: windows
category: process_creation
detection:
selection_shell:
- Image|endswith:
- \powershell.exe
- \powershell_ise.exe
- \pwsh.exe
- \cmd.exe
- OriginalFileName:
- PowerShell.EXE
- powershell_ise.EXE
- pwsh.dll
- Cmd.Exe
selection_user:
User|contains:
- AUTHORI
- AUTORI
LogonId: "0x3e7"
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1