Sigma high test sigma

Suspicious Child Process Created as System

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts

View Source

Detection Logic

{
  "selection": {
    "ParentUser
| contains": [
      "AUTHORI",
      "AUTORI"
    ],
    "ParentUser
| endswith": [
      "\\NETWORK SERVICE",
      "\\LOCAL SERVICE"
    ],
    "User
| contains": [
      "AUTHORI",
      "AUTORI"
    ],
    "User
| endswith": [
      "\\SYSTEM",
      "\\Système",
      "\\СИСТЕМА"
    ],
    "IntegrityLevel": [
      "System",
      "S-1-16-16384"
    ]
  },
  "filter_rundll32": {
    "Image
| endswith": "\\rundll32.exe",
    "CommandLine
| contains": "DavSetCookie"
  },
  "condition": "selection and not 1 of filter_*"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...