{"id":"2617e7ed-adb7-40ba-b0f3-8f9945fe6c09","title":"Suspicious SYSTEM User Process Creation","description":"Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)","author":"Florian Roth (Nextron Systems), David ANDRE (additional keywords)","status":"test","level":"high","date":"2021-12-20","modified":"2025-10-19","tags":["attack.credential-access","attack.privilege-escalation","attack.stealth","attack.t1134","attack.t1003","attack.t1027"],"technique_ids":["T1003","T1027","T1134"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Administrative activity","Scripts and administrative tools used in the monitored environment","Monitoring activity"],"references":["Internal Research","https://tools.thehacker.recipes/mimikatz/modules"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml","source_sha256":"37777daed9f0b531af26282c2c1e5e543df40e7d48a0a857dba12d1de714e2f3","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious SYSTEM User Process Creation\nid: 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09\nstatus: test\ndescription: Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)\nreferences:\n    - Internal Research\n    - https://tools.thehacker.recipes/mimikatz/modules\nauthor: Florian Roth (Nextron Systems), David ANDRE (additional keywords)\ndate: 2021-12-20\nmodified: 2025-10-19\ntags:\n    - attack.credential-access\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.t1134\n    - attack.t1003\n    - attack.t1027\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        IntegrityLevel:\n            - 'System'\n            - 'S-1-16-16384'\n        User|contains: # covers many language settings\n            - 'AUTHORI'\n            - 'AUTORI'\n    selection_special:\n        - Image|endswith:\n              - '\\calc.exe'\n              - '\\cscript.exe'\n              - '\\forfiles.exe'\n              - '\\hh.exe'\n              - '\\mshta.exe'\n              - '\\ping.exe'\n              - '\\wscript.exe'\n        - CommandLine|re: 'net\\s+user\\s+'\n        - CommandLine|contains:\n              # - 'sc stop ' # stops a system service # causes FPs\n              - ' -NoP '  # Often used in malicious PowerShell commands\n              - ' -W Hidden '  # Often used in malicious PowerShell commands\n              - ' -decode '  # Used with certutil\n              - ' /decode '  # Used with certutil\n              - ' /urlcache '  # Used with certutil\n              - ' -urlcache '  # Used with certutil\n              - ' -e* JAB'  # PowerShell encoded commands\n              - ' -e* SUVYI'  # PowerShell encoded commands\n              - ' -e* SQBFAFgA'  # PowerShell encoded commands\n              - ' -e* aWV4I'  # PowerShell encoded commands\n              - ' -e* IAB'  # PowerShell encoded commands\n              - ' -e* PAA'  # PowerShell encoded commands\n              - ' -e* aQBlAHgA'  # PowerShell encoded commands\n              - 'vssadmin delete shadows'  # Ransomware\n              - 'reg SAVE HKLM'  # save registry SAM - syskey extraction\n              - ' -ma '  # ProcDump\n              - 'Microsoft\\Windows\\CurrentVersion\\Run'  # Run key in command line - often in combination with REG ADD\n              - '.downloadstring('  # PowerShell download command\n              - '.downloadfile('  # PowerShell download command\n              - ' /ticket:'  # Rubeus\n              - 'dpapi::'     # Mimikatz\n              - 'event::clear'        # Mimikatz\n              - 'event::drop'     # Mimikatz\n              - 'id::modify'      # Mimikatz\n              - 'kerberos::'       # Mimikatz\n              - 'lsadump::'      # Mimikatz\n              - 'misc::'     # Mimikatz\n              - 'privilege::'       # Mimikatz\n              - 'rpc::'      # Mimikatz\n              - 'sekurlsa::'       # Mimikatz\n              - 'sid::'        # Mimikatz\n              - 'token::'      # Mimikatz\n              - 'vault::cred'     # Mimikatz\n              - 'vault::list'     # Mimikatz\n              - ' p::d '  # Mimikatz\n              - ';iex('  # PowerShell IEX\n              - 'MiniDump'  # Process dumping method apart from procdump\n    filter_main_ping:\n        CommandLine|contains|all:\n            - 'ping'\n            - '127.0.0.1'\n            - ' -n '\n    filter_vs:\n        Image|endswith: '\\PING.EXE'\n        ParentCommandLine|contains: '\\DismFoDInstall.cmd'\n    filter_config_mgr:\n        ParentImage|contains: ':\\Packages\\Plugins\\Microsoft.GuestConfiguration.ConfigurationforWindows\\'\n    filter_java:\n        ParentImage|contains:\n            - ':\\Program Files (x86)\\Java\\'\n            - ':\\Program Files\\Java\\'\n        ParentImage|endswith: '\\bin\\javaws.exe'\n        Image|contains:\n            - ':\\Program Files (x86)\\Java\\'\n            - ':\\Program Files\\Java\\'\n        Image|endswith: '\\bin\\jp2launcher.exe'\n        CommandLine|contains: ' -ma '\n    condition: all of selection* and not 1 of filter_*\nfalsepositives:\n    - Administrative activity\n    - Scripts and administrative tools used in the monitored environment\n    - Monitoring activity\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003","id":"T1003","name":"OS Credential Dumping","page":"techniques/enterprise/T1003/"},{"key":"enterprise/T1027","id":"T1027","name":"Obfuscated Files or Information","page":"techniques/enterprise/T1027/"},{"key":"enterprise/T1134","id":"T1134","name":"Access Token Manipulation","page":"techniques/enterprise/T1134/"}],"data_path":"data/detection-rules/2617e7ed-adb7-40ba-b0f3-8f9945fe6c09.json","kind":"sigma"}