Query: rule covering Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Matching passage: Sigma rule: Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter). Logsource: windows / process_creation. Rule: title: Suspicious SYSTEM User Process Creation id: 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09 status: test description: Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter) references: - Internal Research - https://tools.thehacker.recipes/mimikatz/modules author: Florian Roth (Nextron Systems), David ANDRE (additional keywords) date: 2021-12-20 modified: 2025-10-19 tags: - attack.credential-access - attack.privilege-escalation - attack.stealth - attack.t1134 - attack.t1003 - attack.t1027 logsource: category: process_creation product: windows detection: selection: IntegrityLevel: - System - S-1-16-16384 User|contains: - AUTHORI - AUTORI selection_special: - Image|endswith: - \calc.exe - \cscript.exe - \forfiles.exe - \hh.exe - \mshta.exe - \ping.exe - \wscript.exe - CommandLine|re: net\s+user\s+ - CommandLine|contains: - ' -NoP ' - ' -W Hidden ' - ' -decode ' - ' /decode ' - ' /urlcache ' - ' -urlcache ' - ' -e* JAB' - ' -e* SUVYI' - ' -e* SQBFAFgA' - ' -e* aWV4I' - ' -e* IAB' - ' -e* PAA' - ' -e* aQBlAHgA' - vssadmin delete shadows - reg SAVE HKLM - ' -ma ' - Microsoft\Windows\CurrentVersion\Run - .downloadstring( - .downloadfile( - ' /ticket:' - 'dpapi::' - event::clear - event::drop - id::modify - 'kerberos::' - 'lsadump::' - 'misc::' - 'privilege::' - 'rpc::' - 'sekurlsa::' - 'sid::' - 'token::' - vault::cred - vault::list - ' p::d ' - ;iex( - MiniDump filter_main_ping: CommandLine|contains|all: - ping - 127.0.0.1 - ' -n ' filter_vs: Image|endswith: \PING.EXE ParentCommandLine|contains: \DismFoDInstall.cmd filter_config_mgr: ParentImage|contains: :\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\ filter_java: ParentImage|contains: - :\Program Files (x86)\Java\ - :\Program Files\Java\ ParentImage|endswith: \bin\javaws.exe Image|contains: - :\Program Files (x86)\Java\ - :\Program Files\Java\ Image|endswith: \bin\jp2launcher.exe CommandLine|contains: ' -ma ' condition: all of selection* and not 1 of filter_* falsepositives: - Administrative activity - Scripts and administrative tools used in the monitored environment - Monitoring activity level: high
Near-miss passage: Sigma rule: Detects when an admin share is mounted using net.exe. Logsource: windows / process_creation. Rule: title: Windows Admin Share Mount Via Net.EXE id: 3abd6094-7027-475f-9630-8ab9be7b9725 related: - id: f117933c-980c-4f78-b384-e3d838111165 type: similar status: test description: Detects when an admin share is mounted using net.exe references: - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view author: oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, wagga date: 2020-10-05 modified: 2023-02-21 tags: - attack.lateral-movement - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - ' use ' - ' \\\\*\\*$' condition: all of selection_* falsepositives: - Administrators level: medium