huntrule

Windows Elevated Shell Spawn via Process Creation (PowerShell or CMD)

Flags creation of privileged PowerShell or cmd.exe processes tied to an elevated logon context.

FreeReviewedSigma · Medium · v5
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
Published
2023-11-23
Updated
2026-07-31
AnalysisDetection
title: Windows Elevated Shell Spawn via Process Creation (PowerShell or CMD)
id: b8b60f6b-115a-46c4-8808-68fe257e210a
related:
  - id: 178e615d-e666-498b-9630-9ed363038101
    type: similar
  - id: 61065c72-5d7d-44ef-bf41-6a36684b545f
    type: derived
status: test
description: This rule flags process creation events where a shell binary (PowerShell, PowerShell ISE, pwsh, or cmd) starts with elevated privileges. Elevated shells are a common step in privilege escalation because they enable attackers to run subsequent commands as more-privileged users. The detection relies on Windows process creation telemetry including the image path, original file name, and matching elevated-user indicators via the specific user substring and LogonId.
references:
  - https://github.com/Wh04m1001/SysmonEoP
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_elevated_system_shell.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2023-11-23
modified: 2025-03-06
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.t1059
  - detection.threat-hunting
logsource:
  product: windows
  category: process_creation
detection:
  selection_shell:
    - Image|endswith:
        - \powershell.exe
        - \powershell_ise.exe
        - \pwsh.exe
        - \cmd.exe
    - OriginalFileName:
        - PowerShell.EXE
        - powershell_ise.EXE
        - pwsh.dll
        - Cmd.Exe
  selection_user:
    User|contains:
      - AUTHORI
      - AUTORI
    LogonId: "0x3e7"
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1