Suspicious Cross-User Process Spawn

experimentalmedium
Log-Quelle: windows · process_creationAutor Swachchhanda Shrawan Poudel (Nextron Systems)Datum 2026-07-23
01

Beschreibung

Was dies ist, in Kürze.

Detects suspicious spawning of a process under a different user context than the parent process. Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.

02

Tags

attack.privilege-escalationattack.stealthattack.t1055attack.t1134
03

Regelquelle (YAML)

title: Suspicious Cross-User Process Spawn
id: d2b7a134-9c3e-4f8a-b56d-e0c1f8a29b47
status: experimental
description: |
    Detects suspicious spawning of a process under a different user context than the parent process.
    Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and
    also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.
references:
    - https://github.com/MSNightmare/LegacyHive
    - https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-07-23
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055
    - attack.t1134
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\notepad.exe'
            - '\calc.exe'
            - '\mspaint.exe'
            - '\wordpad.exe'
            - '\write.exe'
    filter_main_same_user:
        User|fieldref: ParentUser
    filter_optional_user_null:
        User: null
    filter_optional_parent_null:
        ParentUser: null
    filter_optional_empty_user:
        - ParentUser:
              - ''
              - '-'
        - User:
              - ''
              - '-'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - RunAs usage spawning one of the listed binaries under a different account
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_cross_user_process_spawn/info.yml
04

erkennt Techniken (2)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.