detection.wiki

Detection rules › Sigma

Potential Executable Run Itself As Sacrificial Process

Status
experimental
Severity
low
Log source
product windows, category process_creation
Author
frack113
Source
github.com/SigmaHQ/sigma

Detects when an executable launches an identical instance of itself, a behavior often used to create a suspended “sacrificial” process for code injection or evasion. Investigate for indicators such as the process being started in suspended mode, rapid parent termination, memory manipulation (e.g., WriteProcessMemory, CreateRemoteThread), or unsigned binaries. Review command-line arguments, process ancestry, and network activity to confirm if this is legitimate behavior or process injection activity.

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1055 Process Injection
StealthT1055 Process Injection

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Potential Executable Run Itself As Sacrificial Process
id: bafd07c6-3ea5-454a-b4be-058fbb073de7
status: experimental
description: |
    Detects when an executable launches an identical instance of itself, a behavior often used to create a suspended “sacrificial” process for code injection or evasion.
    Investigate for indicators such as the process being started in suspended mode, rapid parent termination, memory manipulation (e.g., WriteProcessMemory, CreateRemoteThread), or unsigned binaries.
    Review command-line arguments, process ancestry, and network activity to confirm if this is legitimate behavior or process injection activity.
references:
    - https://www.joesandbox.com/analysis/1605063/0/html
author: frack113
date: 2025-10-17
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|fieldref: ParentImage
    filter_main_path:
        Image|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
    filter_main_original_fn:
        OriginalFileName:
            - 'Cmd.Exe'
            - 'CompatTelRunner.exe'
            - 'Discord.exe'
            - 'electron.exe' # Vs Code
            - 'EXPLORER.EXE'
            - 'httpd.exe'
            - 'IE4UINIT.EXE'
            - 'mmc.exe'
            - 'MpCmdRun.exe'
            - 'mscorsvw.exe'
            - 'msiexec.exe'
            - 'NGenTask.exe'
            - 'OneDriveSetup.exe'
            - 'PowerShell.EXE'
            - 'REGSVR32.EXE'
            - 'smss.exe'
            - 'Spotify.exe'
            - 'WerMgr'
    filter_main_product:
        Product:
            - 'Avira'
            - 'Evernote'
            - 'Firefox'
            - 'Microsoft Office'
            - 'Ninite'
            - 'Opera Browser Assistant Installer'
            - 'Opera Installer'
            - 'Sysinternals Sysmon'
    condition: selection and not 1 of filter_*
falsepositives:
    - Legitimate software that may launch a new instance of itself, especially updaters or installers. Investigate each alert and apply whitelisting as needed.
# Increase the level after some initial tuning in your environment
level: low

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_*

Stage 1: selection

selection:
    Image|fieldref: ParentImage

Stage 2: not filter_*

filter_main_path:
    Image|startswith:
        - 'C:\Program Files\'
        - 'C:\Program Files (x86)\'
filter_main_original_fn:
    OriginalFileName:
        - 'Cmd.Exe'
        - 'CompatTelRunner.exe'
        - 'Discord.exe'
        - 'electron.exe'
        - 'EXPLORER.EXE'
        - 'httpd.exe'
        - 'IE4UINIT.EXE'
        - 'mmc.exe'
        - 'MpCmdRun.exe'
        - 'mscorsvw.exe'
        - 'msiexec.exe'
        - 'NGenTask.exe'
        - 'OneDriveSetup.exe'
        - 'PowerShell.EXE'
        - 'REGSVR32.EXE'
        - 'smss.exe'
        - 'Spotify.exe'
        - 'WerMgr'
filter_main_product:
    Product:
        - 'Avira'
        - 'Evernote'
        - 'Firefox'
        - 'Microsoft Office'
        - 'Ninite'
        - 'Opera Browser Assistant Installer'
        - 'Opera Installer'
        - 'Sysinternals Sysmon'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
Imagestarts_withC:\Program Files (x86)\
Imagestarts_withC:\Program Files\
OriginalFileNameeqCmd.Exe
OriginalFileNameeqCompatTelRunner.exe
OriginalFileNameeqDiscord.exe
OriginalFileNameeqEXPLORER.EXE
OriginalFileNameeqIE4UINIT.EXE
OriginalFileNameeqMpCmdRun.exe
OriginalFileNameeqNGenTask.exe
OriginalFileNameeqOneDriveSetup.exe
OriginalFileNameeqPowerShell.EXE
OriginalFileNameeqREGSVR32.EXE
OriginalFileNameeqSpotify.exe
OriginalFileNameeqWerMgr
OriginalFileNameeqelectron.exe
OriginalFileNameeqhttpd.exe
OriginalFileNameeqmmc.exe
OriginalFileNameeqmscorsvw.exe
OriginalFileNameeqmsiexec.exe
OriginalFileNameeqsmss.exe
ProducteqAvira
ProducteqEvernote
ProducteqFirefox
ProducteqMicrosoft Office
ProducteqNinite
ProducteqOpera Browser Assistant Installer
ProducteqOpera Installer
ProducteqSysinternals Sysmon

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imagecross_field_compare
  • ParentImage transforms: op:eq