
title: Suspicious Child Process Created as System
author: Teymur Kheirkhabarov, Roberto Rodriguez (@Cyb3rWard0g), Open Threat Research
  (OTR)
date: 2019/10/26
description: Detection of child processes spawned with SYSTEM privileges by parents
  with LOCAL SERVICE or NETWORK SERVICE accounts
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    ParentUser:
    - NT AUTHORITY\NETWORK SERVICE
    - NT AUTHORITY\LOCAL SERVICE
    - AUTORITE NT\
  SELECTION_3:
    User:
    - NT AUTHORITY\SYSTEM
    - AUTORITE NT\Sys
  SELECTION_4:
    IntegrityLevel: System
  SELECTION_5:
    Image: '*\rundll32.exe'
  SELECTION_6:
    CommandLine: '*DavSetCookie*'
  condition: (SELECTION_1 and (SELECTION_2 and SELECTION_3 and SELECTION_4) and  not
    (SELECTION_5 and SELECTION_6))
falsepositives:
- Unknown
id: 590a5f4c-6c8c-4f10-8307-89afe9453a9d
level: high
logsource:
  category: process_creation
  definition: ParentUser field needs sysmon >= 13.30
  product: windows
modified: 2020/10/26
references:
- https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
- https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/
- https://github.com/antonioCoco/RogueWinRM
- https://twitter.com/Cyb3rWard0g/status/1453123054243024897
status: experimental
tags:
- attack.privilege_escalation
- attack.t1134
- attack.t1134.002
ruletype: SIGMA
