Detection rules › Splunk

Windows Privilege Escalation System Process Without System Parent

Author
Steven Dick
Source
upstream

The following analytic detects any system integrity level process spawned by a non-system account. It leverages Sysmon EventID 1, focusing on process integrity and parent user data. This behavior is significant as it often indicates successful privilege escalation to SYSTEM from a user-controlled process or service. If confirmed malicious, this activity could allow an attacker to gain full control over the system, execute arbitrary code, and potentially compromise the entire environment.

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1068 Exploitation for Privilege Escalation, T1134 Access Token Manipulation, T1548 Abuse Elevation Control Mechanism
Defense EvasionT1134 Access Token Manipulation, T1548 Abuse Elevation Control Mechanism

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: search

search NOT ParentUser IN ("*$", "*DWM-*", "*LOCAL SERVICE", "*NETWORK SERVICE", "*SYSTEM", "-") EventCode=1 IntegrityLevel="system" ParentUser="*"

Stage 2: eval

eval ... using (ParentUser)

Stage 3: stats

stats BY action, dest, original_file_name, parent_process, parent_process_exec, parent_process_guid, parent_process_id, parent_process_name, parent_process_path, process, process_exec, process_guid, process_hash, process_id, process_integrity_level, process_name, process_path, user, user_id, vendor_product, src_user

Stage 4: search

search

Stage 5: search

search

Stage 6: search

search `macro`

Exclusions

Top-level NOT(...) conjuncts — predicates this rule actively suppresses.

StageFieldKindExcluded values
1ParentUserin"*$", "*DWM-*", "*LOCAL SERVICE", "*NETWORK SERVICE", "*SYSTEM", "-"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 1 corpus 3 (splunk 3)
IntegrityLeveleq
  • "system" corpus 2 (splunk 2)
ParentUsereq
  • *

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.