Sunturai
Back to results
MediumSplunk security contentSteven Dick

Windows Privilege Escalation System Process Without System Parent

The following analytic detects any system integrity level process spawned by a non-system account. It leverages Sysmon EventID 1, focusing on process integrity and parent user data. This behavior is significant as it…

Description

The following analytic detects any system integrity level process spawned by a non-system account. It leverages Sysmon EventID 1, focusing on process integrity and parent user data. This behavior is significant as it often indicates successful privilege escalation to SYSTEM from a user-controlled process or service. If confirmed malicious, this activity could allow an attacker to gain full control over the system, execute arbitrary code, and potentially compromise the entire environment.

Detection logic

Detection requirements

Platform
ContainersIaaSIdentity ProviderLinuxmacOSOffice SuiteWindows

The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Log source category
sysmon_eventid_1

Known benign triggers

  • No false positives have been identified at this time.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice