{"id":"0a98a10c-685d-4ab0-bddc-b6bdd1d48458","title":"Uncommon Userinit Child Process","description":"Detects uncommon \"userinit.exe\" child processes, which could be a sign of uncommon shells or login scripts used for persistence.","author":"Tom Ueltschi (@c_APT_ure), Tim Shelton","status":"test","level":"high","date":"2019-01-12","modified":"2023-11-14","tags":["attack.privilege-escalation","attack.t1037.001","attack.persistence"],"technique_ids":["T1037.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate logon scripts or custom shells may trigger false positives. Apply additional filters accordingly."],"references":["https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html","https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig#powershell-is-the-default-shell-on-server-core"],"source_path":"rules/windows/process_creation/proc_creation_win_userinit_uncommon_child_processes.yml","source_sha256":"b45a42afea068960b373e3c37dd1b690bd8eea58ce66c63746a790b209b5ed66","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_userinit_uncommon_child_processes.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Uncommon Userinit Child Process\nid: 0a98a10c-685d-4ab0-bddc-b6bdd1d48458\nrelated:\n    - id: 21d856f9-9281-4ded-9377-51a1a6e2a432\n      type: similar\nstatus: test\ndescription: Detects uncommon \"userinit.exe\" child processes, which could be a sign of uncommon shells or login scripts used for persistence.\nreferences:\n    - https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html\n    - https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig#powershell-is-the-default-shell-on-server-core\nauthor: Tom Ueltschi (@c_APT_ure), Tim Shelton\ndate: 2019-01-12\nmodified: 2023-11-14\ntags:\n    - attack.privilege-escalation\n    - attack.t1037.001\n    - attack.persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\userinit.exe'\n    filter_main_explorer:\n        Image|endswith: ':\\WINDOWS\\explorer.exe'\n    filter_optional_logonscripts:\n        CommandLine|contains:\n            - 'netlogon.bat'\n            - 'UsrLogon.cmd'\n    filter_optional_windows_core:\n        # Note: This filter is mandatory on Windows Core machines as the default shell spawned by \"userinit\" is \"powershell.exe\".\n        # https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig#powershell-is-the-default-shell-on-server-core\n        CommandLine: 'PowerShell.exe'\n    filter_optional_proquota:\n        Image|endswith:\n            - ':\\Windows\\System32\\proquota.exe'\n            - ':\\Windows\\SysWOW64\\proquota.exe'\n    filter_optional_citrix:\n        Image|endswith:\n            # As reported by https://github.com/SigmaHQ/sigma/issues/4569\n            - ':\\Program Files (x86)\\Citrix\\HDX\\bin\\cmstart.exe' # https://support.citrix.com/article/CTX983798/purpose-of-cmstart-command\n            - ':\\Program Files (x86)\\Citrix\\HDX\\bin\\icast.exe' # https://support.citrix.com/article/CTX983798/purpose-of-cmstart-command\n            - ':\\Program Files (x86)\\Citrix\\System32\\icast.exe'\n            - ':\\Program Files\\Citrix\\HDX\\bin\\cmstart.exe' # https://support.citrix.com/article/CTX983798/purpose-of-cmstart-command\n            - ':\\Program Files\\Citrix\\HDX\\bin\\icast.exe' # https://support.citrix.com/article/CTX983798/purpose-of-cmstart-command\n            - ':\\Program Files\\Citrix\\System32\\icast.exe'\n    filter_optional_image_null:\n        Image: null\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate logon scripts or custom shells may trigger false positives. Apply additional filters accordingly.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1037.001","id":"T1037.001","name":"Logon Script (Windows)","page":"techniques/enterprise/T1037.001/"}],"data_path":"data/detection-rules/0a98a10c-685d-4ab0-bddc-b6bdd1d48458.json","kind":"sigma"}