detection.wiki

Detection rules › Sigma

Suspicious Sysmon as Execution Parent

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Florian Roth (Nextron Systems), Tim Shelton (fp werfault)
Source
github.com/SigmaHQ/sigma

Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1068 Exploitation for Privilege Escalation

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation
Security-AuditingEvent ID 4688A new process has been created.

Rule body yaml

title: Suspicious Sysmon as Execution Parent
id: 6d1058a4-407e-4f3a-a144-1968c11dc5c3
status: test
description: Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41120
    - https://twitter.com/filip_dragovic/status/1590052248260055041
    - https://twitter.com/filip_dragovic/status/1590104354727436290
author: Florian Roth (Nextron Systems), Tim Shelton (fp werfault)
date: 2022-11-10
modified: 2025-07-04
tags:
    - attack.privilege-escalation
    - attack.t1068
    - cve.2022-41120
    - detection.emerging-threats
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith:
            - '\Sysmon.exe'
            - '\Sysmon64.exe'
    filter_main_temp_sysmon:
        # C:\Users\ADMINI~1\AppData\Local\Temp\2\Sysmon.exe
        Image|startswith: 'C:\Users\'
        Image|contains: '\AppData\Local\Temp\'
        Image|endswith:
            - '\Sysmon.exe'
            - '\Sysmon64.exe'
    filter_main_generic:
        Image|contains:
            - ':\Windows\Sysmon.exe'
            - ':\Windows\Sysmon64.exe'
            - ':\Windows\System32\conhost.exe'
            - ':\Windows\System32\WerFault.exe' # When Sysmon crashes
            - ':\Windows\System32\WerFaultSecure.exe' # When Sysmon crashes
            - ':\Windows\System32\wevtutil.exe'
            - ':\Windows\SysWOW64\wevtutil.exe'
    filter_main_null:
        Image: null
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_*

Stage 1: selection

selection:
    ParentImage|endswith:
        - '\Sysmon.exe'
        - '\Sysmon64.exe'

Stage 2: not filter_main_*

filter_main_temp_sysmon:
    Image|startswith: 'C:\Users\'
    Image|contains: '\AppData\Local\Temp\'
    Image|endswith:
        - '\Sysmon.exe'
        - '\Sysmon64.exe'
filter_main_generic:
    Image|contains:
        - ':\Windows\Sysmon.exe'
        - ':\Windows\Sysmon64.exe'
        - ':\Windows\System32\conhost.exe'
        - ':\Windows\System32\WerFault.exe'
        - ':\Windows\System32\WerFaultSecure.exe'
        - ':\Windows\System32\wevtutil.exe'
        - ':\Windows\SysWOW64\wevtutil.exe'
filter_main_null:
    Image: null

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
Imageends_with\Sysmon.exe
Imageends_with\Sysmon64.exe
Imagematch\AppData\Local\Temp\
Imagestarts_withC:\Users\
Imageis_null(no value, null check)
Imagematch:\Windows\SysWOW64\wevtutil.exe
Imagematch:\Windows\Sysmon.exe
Imagematch:\Windows\Sysmon64.exe
Imagematch:\Windows\System32\WerFault.exe
Imagematch:\Windows\System32\WerFaultSecure.exe
Imagematch:\Windows\System32\conhost.exe
Imagematch:\Windows\System32\wevtutil.exe

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ParentImageends_with
  • \Sysmon.exe
  • \Sysmon64.exe