{"id":"178e615d-e666-498b-9630-9ed363038101","title":"Elevated System Shell Spawned From Uncommon Parent Location","description":"Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.","author":"frack113, Tim Shelton (update fp)","status":"test","level":"medium","date":"2022-12-05","modified":"2025-03-06","tags":["attack.privilege-escalation","attack.execution","attack.t1059"],"technique_ids":["T1059"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Some legitimate applications may spawn shells from uncommon parent locations. Apply additional filters and perform an initial baseline before deploying."],"references":["https://github.com/Wh04m1001/SysmonEoP"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_elevated_system_shell_uncommon_parent.yml","source_sha256":"6fc1a68a59218ff8711cf09579e9a02bb2ed69abe27314cc4941be07cda152ec","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_elevated_system_shell_uncommon_parent.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Elevated System Shell Spawned From Uncommon Parent Location\nid: 178e615d-e666-498b-9630-9ed363038101\nrelated:\n    - id: 61065c72-5d7d-44ef-bf41-6a36684b545f\n      type: similar\nstatus: test\ndescription: Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.\nreferences:\n    - https://github.com/Wh04m1001/SysmonEoP\nauthor: frack113, Tim Shelton (update fp)\ndate: 2022-12-05\nmodified: 2025-03-06\ntags:\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.t1059\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_shell:\n        - Image|endswith:\n              - '\\powershell.exe'\n              - '\\powershell_ise.exe'\n              - '\\pwsh.exe'\n              - '\\cmd.exe'\n        - OriginalFileName:\n              - 'PowerShell.EXE'\n              - 'powershell_ise.EXE'\n              - 'pwsh.dll'\n              - 'Cmd.Exe'\n    selection_user:\n        User|contains: # covers many language settings\n            - 'AUTHORI'\n            - 'AUTORI'\n        LogonId: '0x3e7'\n    filter_main_generic:\n        # Example 1:\n        #   C:\\Program Files\\erl-23.2\\erts-11.1.4\\bin\\erl.exe\" -service_event ErlSrv_RabbitMQ -nohup -sname rabbit@localhost -s rabbit boot -boot start_sasl +W w +MBas ageffcbf +MHas ageffcbf +MBlmbcs 512 +MHlmbcs 512 +MMmcs 30 +P 1048576 +t 5000000 +stbt db +zdbbl 128000 +sbwt none +sbwtdcpu none +sbwtdio none -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672 -lager crash_log false -lager handlers []\n        # Example 2:\n        #   ParentImage: C:\\Program Files (x86)\\Varonis\\DatAdvantage\\GridCollector\\VrnsRealTimeAlertsSvc.exe\" /appid 000000ad-cb03-500b-9459-c46d000000ad\n        #   CommandLine: C:\\Windows\\system32\\cmd.exe /c C:\\Program Files \"(x86)\\Varonis\\DatAdvantage\\GridCollector\\handle_scopes.cmd C:\\Collector\" Working Share\\VaronisWorkDirectoryCollector\n        ParentImage|contains:\n            - ':\\Program Files (x86)\\'\n            - ':\\Program Files\\'\n            - ':\\ProgramData\\'\n            - ':\\Windows\\System32\\'\n            - ':\\Windows\\SysWOW64\\'\n            - ':\\Windows\\Temp\\' # Installers\n            - ':\\Windows\\WinSxS\\'\n    filter_optional_manageengine:\n        # Example:\n        #   ParentImage: C:/ManageEngine/ADManager Plus/pgsql/bin/postgres.exe\" --forkarch 5380\n        #   CommandLine: C:\\Windows\\system32\\cmd.exe /c \"IF EXIST archive.bat (archive.bat pg_wal\\000000010000008E000000EA 000000010000008E000000EA)\n        ParentImage|endswith: ':\\ManageEngine\\ADManager Plus\\pgsql\\bin\\postgres.exe'\n        Image|endswith: '\\cmd.exe'\n    filter_optional_asgard:\n        CommandLine|contains: ':\\WINDOWS\\system32\\cmd.exe /c \"'\n        CurrentDirectory|contains: ':\\WINDOWS\\Temp\\asgard2-agent\\'\n    filter_optional_ibm_spectrumprotect:\n        ParentImage|contains: ':\\IBM\\SpectrumProtect\\webserver\\scripts\\'\n        CommandLine|contains: ':\\IBM\\SpectrumProtect\\webserver\\scripts\\'\n    filter_main_parent_null:\n        ParentImage: null\n    filter_main_parent_empty:\n        ParentImage:\n            - ''\n            - '-'\n    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Some legitimate applications may spawn shells from uncommon parent locations. Apply additional filters and perform an initial baseline before deploying.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"}],"data_path":"data/detection-rules/178e615d-e666-498b-9630-9ed363038101.json","kind":"sigma"}