Sunturai
Back to results
MediumSplunk security contentSteven Dick

Windows Privilege Escalation User Process Spawn System Process

The following analytic detects when a process with low, medium, or high integrity spawns a system integrity process from a user-controlled location. This behavior is indicative of privilege escalation attempts where…

Description

The following analytic detects when a process with low, medium, or high integrity spawns a system integrity process from a user-controlled location. This behavior is indicative of privilege escalation attempts where attackers elevate their privileges to SYSTEM level from a user-controlled process or service. The detection leverages Sysmon data, specifically Event ID 15, to identify such transitions. Monitoring this activity is crucial as it can signify an attacker gaining SYSTEM-level access, potentially leading to full control over the affected system, unauthorized access to sensitive data, and further malicious activities.

Detection logic

Detection requirements

Platform
ContainersIaaSIdentity ProviderLinuxmacOSOffice SuiteWindows

The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Log source category
sysmon_eventid_1_and_sysmon_eventid_1

Known benign triggers

  • No false positives have been identified at this time.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice