Windows userinit.exe Spawns Uncommon Child Processes
Alerts when userinit.exe starts an unexpected child process during logon, suggesting potential persistence via modified logon behavior.
- Product
- windows
- Category
- process_creation
- Author
- Tom Ueltschi (@c_APT_ure), Tim Shelton (SigmaHQ), DRL 1.1
- Published
- 2019-01-12
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where the parent process image ends with \userinit.exe and the resulting child process is not a known/common expected shell. Attackers may abuse the userinit launch path to start custom shells or login/persistence workflows immediately after user logon. The detection relies on Windows process creation telemetry, specifically ParentImage and the child process Image and CommandLine fields, with exclusions for common benign cases like Explorer, PowerShell on Windows Core, and selected vendor utilities.
Reporting behind it
- cocomelonc.github.iohttps://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig#powershell-is-the-default-shell-on-server-core
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_userinit_uncommon_child_processes.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows userinit.exe Spawns Uncommon Child Processes
id: 76f2bd0d-3f27-4c39-83ca-c1cdc805378c
related:
- id: 21d856f9-9281-4ded-9377-51a1a6e2a432
type: similar
- id: 0a98a10c-685d-4ab0-bddc-b6bdd1d48458
type: derived
status: test
description: This rule flags process creation events where the parent process image ends with \userinit.exe and the resulting child process is not a known/common expected shell. Attackers may abuse the userinit launch path to start custom shells or login/persistence workflows immediately after user logon. The detection relies on Windows process creation telemetry, specifically ParentImage and the child process Image and CommandLine fields, with exclusions for common benign cases like Explorer, PowerShell on Windows Core, and selected vendor utilities.
references:
- https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html
- https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig#powershell-is-the-default-shell-on-server-core
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_userinit_uncommon_child_processes.yml
author: Tom Ueltschi (@c_APT_ure), Tim Shelton, Huntrule Team
date: 2019-01-12
modified: 2023-11-14
tags:
- attack.privilege-escalation
- attack.t1037.001
- attack.persistence
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \userinit.exe
filter_main_explorer:
Image|endswith: :\WINDOWS\explorer.exe
filter_optional_logonscripts:
CommandLine|contains:
- netlogon.bat
- UsrLogon.cmd
filter_optional_windows_core:
CommandLine: PowerShell.exe
filter_optional_proquota:
Image|endswith:
- :\Windows\System32\proquota.exe
- :\Windows\SysWOW64\proquota.exe
filter_optional_citrix:
Image|endswith:
- :\Program Files (x86)\Citrix\HDX\bin\cmstart.exe
- :\Program Files (x86)\Citrix\HDX\bin\icast.exe
- :\Program Files (x86)\Citrix\System32\icast.exe
- :\Program Files\Citrix\HDX\bin\cmstart.exe
- :\Program Files\Citrix\HDX\bin\icast.exe
- :\Program Files\Citrix\System32\icast.exe
filter_optional_image_null:
Image: null
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Legitimate logon scripts or custom shells may trigger false positives. Apply additional filters accordingly.
level: high
license: DRL-1.1