Query: detection rule: Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a
Matching passage: Sigma rule: Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a. Logsource: windows / process_creation. Rule: title: Elevated System Shell Spawned From Uncommon Parent Location id: 178e615d-e666-498b-9630-9ed363038101 related: - id: 61065c72-5d7d-44ef-bf41-6a36684b545f type: similar status: test description: Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location. references: - https://github.com/Wh04m1001/SysmonEoP author: frack113, Tim Shelton (update fp) date: 2022-12-05 modified: 2025-03-06 tags: - attack.privilege-escalation - attack.execution - attack.t1059 logsource: product: windows category: process_creation detection: selection_shell: - Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe - \cmd.exe - OriginalFileName: - PowerShell.EXE - powershell_ise.EXE - pwsh.dll - Cmd.Exe selection_user: User|contains: - AUTHORI - AUTORI LogonId: '0x3e7' filter_main_generic: ParentImage|contains: - :\Program Files (x86)\ - :\Program Files\ - :\ProgramData\ - :\Windows\System32\ - :\Windows\SysWOW64\ - :\Windows\Temp\ - :\Windows\WinSxS\ filter_optional_manageengine: ParentImage|endswith: :\ManageEngine\ADManager Plus\pgsql\bin\postgres.exe Image|endswith: \cmd.exe filter_optional_asgard: CommandLine|contains: :\WINDOWS\system32\cmd.exe /c " CurrentDirectory|contains: :\WINDOWS\Temp\asgard2-agent\ filter_optional_ibm_spectrumprotect: ParentImage|contains: :\IBM\SpectrumProtect\webserver\scripts\ CommandLine|contains: :\IBM\SpectrumProtect\webserver\scripts\ filter_main_parent_null: ParentImage: null filter_main_parent_empty: ParentImage: - '' - '-' condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Some legitimate applications may spawn shells from uncommon parent locations. Apply additional filters and perform an initial baseline before deploying. level: medium
Near-miss passage: Sigma rule: Detects the creation of a schtask via PowerSploit or Empire Default Configuration.. Logsource: windows / process_creation. Rule: title: HackTool - Default PowerSploit/Empire Scheduled Task Creation id: 56c217c3-2de2-479b-990f-5c109ba8458f status: test description: Detects the creation of a schtask via PowerSploit or Empire Default Configuration. references: - https://github.com/0xdeadbeefJERKY/PowerSploit/blob/8690399ef70d2cad10213575ac67e8fa90ddf7c3/Persistence/Persistence.psm1 - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/powershell/persistence/userland/schtasks.py author: Markus Neis, @Karneades date: 2018-03-06 modified: 2023-03-03 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.s0111 - attack.g0022 - attack.g0060 - car.2013-08-001 - attack.t1053.005 - attack.t1059.001 logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: - \powershell.exe - \pwsh.exe Image|endswith: \schtasks.exe CommandLine|contains|all: - /Create - powershell.exe -NonI - /TN Updater /TR CommandLine|contains: - /SC ONLOGON - /SC DAILY /ST - /SC ONIDLE - /SC HOURLY condition: selection falsepositives: - Unlikely level: high