Detection rules › Sigma
Potential Executable Run Itself As Sacrificial Process
Detects when an executable launches an identical instance of itself, a behavior often used to create a suspended “sacrificial” process for code injection or evasion. Investigate for indicators such as the process being started in suspended mode, rapid parent termination, memory manipulation (e.g., WriteProcessMemory, CreateRemoteThread), or unsigned binaries. Review command-line arguments, process ancestry, and network activity to confirm if this is legitimate behavior or process injection activity.
Known false positives
- Legitimate software that may launch a new instance of itself, especially updaters or installers. Investigate each alert and apply whitelisting as needed.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | |
| Stealth |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
title: Potential Executable Run Itself As Sacrificial Process
id: bafd07c6-3ea5-454a-b4be-058fbb073de7
status: experimental
description: |
Detects when an executable launches an identical instance of itself, a behavior often used to create a suspended “sacrificial” process for code injection or evasion.
Investigate for indicators such as the process being started in suspended mode, rapid parent termination, memory manipulation (e.g., WriteProcessMemory, CreateRemoteThread), or unsigned binaries.
Review command-line arguments, process ancestry, and network activity to confirm if this is legitimate behavior or process injection activity.
references:
- https://www.joesandbox.com/analysis/1605063/0/html
author: frack113
date: 2025-10-17
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1055
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection:
Image|fieldref: ParentImage
filter_main_path:
Image|startswith:
- 'C:\Program Files\'
- 'C:\Program Files (x86)\'
filter_main_original_fn:
OriginalFileName:
- 'Cmd.Exe'
- 'CompatTelRunner.exe'
- 'Discord.exe'
- 'electron.exe' # Vs Code
- 'EXPLORER.EXE'
- 'httpd.exe'
- 'IE4UINIT.EXE'
- 'mmc.exe'
- 'MpCmdRun.exe'
- 'mscorsvw.exe'
- 'msiexec.exe'
- 'NGenTask.exe'
- 'OneDriveSetup.exe'
- 'PowerShell.EXE'
- 'REGSVR32.EXE'
- 'smss.exe'
- 'Spotify.exe'
- 'WerMgr'
filter_main_product:
Product:
- 'Avira'
- 'Evernote'
- 'Firefox'
- 'Microsoft Office'
- 'Ninite'
- 'Opera Browser Assistant Installer'
- 'Opera Installer'
- 'Sysinternals Sysmon'
condition: selection and not 1 of filter_*
falsepositives:
- Legitimate software that may launch a new instance of itself, especially updaters or installers. Investigate each alert and apply whitelisting as needed.
# Increase the level after some initial tuning in your environment
level: low
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_*Stage 1: selection
selection:
Image|fieldref: ParentImage
Stage 2: not filter_*
filter_main_path:
Image|startswith:
- 'C:\Program Files\'
- 'C:\Program Files (x86)\'
filter_main_original_fn:
OriginalFileName:
- 'Cmd.Exe'
- 'CompatTelRunner.exe'
- 'Discord.exe'
- 'electron.exe'
- 'EXPLORER.EXE'
- 'httpd.exe'
- 'IE4UINIT.EXE'
- 'mmc.exe'
- 'MpCmdRun.exe'
- 'mscorsvw.exe'
- 'msiexec.exe'
- 'NGenTask.exe'
- 'OneDriveSetup.exe'
- 'PowerShell.EXE'
- 'REGSVR32.EXE'
- 'smss.exe'
- 'Spotify.exe'
- 'WerMgr'
filter_main_product:
Product:
- 'Avira'
- 'Evernote'
- 'Firefox'
- 'Microsoft Office'
- 'Ninite'
- 'Opera Browser Assistant Installer'
- 'Opera Installer'
- 'Sysinternals Sysmon'
Exclusions
The rule actively suppresses these predicates.
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Image | cross_field_compare |
| field:"Image" kind:cross_field_compare value:"ParentImage" |