Abused Debug Privilege by Arbitrary Parent Processes

{
  "selection_parent": {
    "ParentImage
| endswith": [
      "\\winlogon.exe",
      "\\services.exe",
      "\\lsass.exe",
      "\\csrss.exe",
      "\\smss.exe",
      "\\wininit.exe",
      "\\spoolsv.exe",
      "\\searchindexer.exe"
    ],
    "User
| contains": [
      "AUTHORI",
      "AUTORI"
    ]
  },
  "selection_img": [
    {
      "Image
| endswith": [
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\cmd.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll",
        "Cmd.Exe"
      ]
    }
  ],
  "filter": {
    "CommandLine
| contains
| all": [
      " route ",
      " ADD "
    ]
  },
  "condition": "all of selection_* and not filter"
}

False Positives

• ⚠ Unknown