Windows ImagingDevices.exe Spawns Unusual Parent/Child Processes
Alerts when ImagingDevices.exe participates in atypical process parent/child chains on Windows, based on process creation telemetry.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-27
- Updated
- 2026-07-31
What it detects
This rule flags process creation events where ImagingDevices.exe is seen with atypical related process ancestry, including ImagingDevices.exe running as a child of common system hosts like WmiPrvSE.exe, svchost.exe, or dllhost.exe, or spawning child processes tied to ImagingDevices.exe. Attackers may use legitimate binaries to blend in, so unusual process relationships can indicate stealthy execution or lateral abuse. Telemetry relies on Windows process creation fields for Image and ParentImage (including suffix matching).
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows ImagingDevices.exe Spawns Unusual Parent/Child Processes
id: b3dfebfa-6cfc-4d39-8f83-3db3b65541a3
status: test
description: This rule flags process creation events where ImagingDevices.exe is seen with atypical related process ancestry, including ImagingDevices.exe running as a child of common system hosts like WmiPrvSE.exe, svchost.exe, or dllhost.exe, or spawning child processes tied to ImagingDevices.exe. Attackers may use legitimate binaries to blend in, so unusual process relationships can indicate stealthy execution or lateral abuse. Telemetry relies on Windows process creation fields for Image and ParentImage (including suffix matching).
references:
- https://thedfirreport.com/2022/09/26/bumblebee-round-two/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_imagingdevices_unusual_parents.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-27
modified: 2022-12-29
tags:
- attack.execution
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \WmiPrvSE.exe
- \svchost.exe
- \dllhost.exe
Image|endswith: \ImagingDevices.exe
selection_child:
ParentImage|endswith: \ImagingDevices.exe
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: f11f2808-adb4-46c0-802a-8660db50fa99
type: derived