Windows userinit.exe Spawns Uncommon Child Processes

Alerts when userinit.exe starts an unexpected child process during logon, suggesting potential persistence via modified logon behavior.

FreeUnreviewedSigmahighv1

windows-userinit-exe-spawns-uncommon-child-processes-0a98a10c

title: Windows userinit.exe Spawns Uncommon Child Processes
id: 76f2bd0d-3f27-4c39-83ca-c1cdc805378c
related:
  - id: 21d856f9-9281-4ded-9377-51a1a6e2a432
    type: similar
  - id: 0a98a10c-685d-4ab0-bddc-b6bdd1d48458
    type: derived
status: test
description: This rule flags process creation events where the parent process image ends with \userinit.exe and the resulting child process is not a known/common expected shell. Attackers may abuse the userinit launch path to start custom shells or login/persistence workflows immediately after user logon. The detection relies on Windows process creation telemetry, specifically ParentImage and the child process Image and CommandLine fields, with exclusions for common benign cases like Explorer, PowerShell on Windows Core, and selected vendor utilities.
references:
  - https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html
  - https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig#powershell-is-the-default-shell-on-server-core
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_userinit_uncommon_child_processes.yml
author: Tom Ueltschi (@c_APT_ure), Tim Shelton, Huntrule Team
date: 2019-01-12
modified: 2023-11-14
tags:
  - attack.privilege-escalation
  - attack.t1037.001
  - attack.persistence
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \userinit.exe
  filter_main_explorer:
    Image|endswith: :\WINDOWS\explorer.exe
  filter_optional_logonscripts:
    CommandLine|contains:
      - netlogon.bat
      - UsrLogon.cmd
  filter_optional_windows_core:
    CommandLine: PowerShell.exe
  filter_optional_proquota:
    Image|endswith:
      - :\Windows\System32\proquota.exe
      - :\Windows\SysWOW64\proquota.exe
  filter_optional_citrix:
    Image|endswith:
      - :\Program Files (x86)\Citrix\HDX\bin\cmstart.exe
      - :\Program Files (x86)\Citrix\HDX\bin\icast.exe
      - :\Program Files (x86)\Citrix\System32\icast.exe
      - :\Program Files\Citrix\HDX\bin\cmstart.exe
      - :\Program Files\Citrix\HDX\bin\icast.exe
      - :\Program Files\Citrix\System32\icast.exe
  filter_optional_image_null:
    Image: null
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate logon scripts or custom shells may trigger false positives. Apply additional filters accordingly.
level: high
license: DRL-1.1

What it detects

This rule flags process creation events where the parent process image ends with \userinit.exe and the resulting child process is not a known/common expected shell. Attackers may abuse the userinit launch path to start custom shells or login/persistence workflows immediately after user logon. The detection relies on Windows process creation telemetry, specifically ParentImage and the child process Image and CommandLine fields, with exclusions for common benign cases like Explorer, PowerShell on Windows Core, and selected vendor utilities.

Known false positives

Legitimate logon scripts or custom shells may trigger false positives. Apply additional filters accordingly.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.