Detection rules › Sigma

Potential Executable Run Itself As Sacrificial Process

Status
experimental
Severity
low
Log source
category process_creation, product windows
Author
frack113
Source
github.com/SigmaHQ/sigma

Detects when an executable launches an identical instance of itself, a behavior often used to create a suspended “sacrificial” process for code injection or evasion. Investigate for indicators such as the process being started in suspended mode, rapid parent termination, memory manipulation (e.g., WriteProcessMemory, CreateRemoteThread), or unsigned binaries. Review command-line arguments, process ancestry, and network activity to confirm if this is legitimate behavior or process injection activity.

Known false positives

  • Legitimate software that may launch a new instance of itself, especially updaters or installers. Investigate each alert and apply whitelisting as needed.

MITRE ATT&CK coverage

TacticTechniques
Privilege Escalation
Stealth

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 1: Process creation

Rule body

title: Potential Executable Run Itself As Sacrificial Process
id: bafd07c6-3ea5-454a-b4be-058fbb073de7
status: experimental
description: |
    Detects when an executable launches an identical instance of itself, a behavior often used to create a suspended “sacrificial” process for code injection or evasion.
    Investigate for indicators such as the process being started in suspended mode, rapid parent termination, memory manipulation (e.g., WriteProcessMemory, CreateRemoteThread), or unsigned binaries.
    Review command-line arguments, process ancestry, and network activity to confirm if this is legitimate behavior or process injection activity.
references:
    - https://www.joesandbox.com/analysis/1605063/0/html
author: frack113
date: 2025-10-17
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|fieldref: ParentImage
    filter_main_path:
        Image|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
    filter_main_original_fn:
        OriginalFileName:
            - 'Cmd.Exe'
            - 'CompatTelRunner.exe'
            - 'Discord.exe'
            - 'electron.exe' # Vs Code
            - 'EXPLORER.EXE'
            - 'httpd.exe'
            - 'IE4UINIT.EXE'
            - 'mmc.exe'
            - 'MpCmdRun.exe'
            - 'mscorsvw.exe'
            - 'msiexec.exe'
            - 'NGenTask.exe'
            - 'OneDriveSetup.exe'
            - 'PowerShell.EXE'
            - 'REGSVR32.EXE'
            - 'smss.exe'
            - 'Spotify.exe'
            - 'WerMgr'
    filter_main_product:
        Product:
            - 'Avira'
            - 'Evernote'
            - 'Firefox'
            - 'Microsoft Office'
            - 'Ninite'
            - 'Opera Browser Assistant Installer'
            - 'Opera Installer'
            - 'Sysinternals Sysmon'
    condition: selection and not 1 of filter_*
falsepositives:
    - Legitimate software that may launch a new instance of itself, especially updaters or installers. Investigate each alert and apply whitelisting as needed.
# Increase the level after some initial tuning in your environment
level: low

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_*

Stage 1: selection

selection:
    Image|fieldref: ParentImage

Stage 2: not filter_*

filter_main_path:
    Image|startswith:
        - 'C:\Program Files\'
        - 'C:\Program Files (x86)\'
filter_main_original_fn:
    OriginalFileName:
        - 'Cmd.Exe'
        - 'CompatTelRunner.exe'
        - 'Discord.exe'
        - 'electron.exe'
        - 'EXPLORER.EXE'
        - 'httpd.exe'
        - 'IE4UINIT.EXE'
        - 'mmc.exe'
        - 'MpCmdRun.exe'
        - 'mscorsvw.exe'
        - 'msiexec.exe'
        - 'NGenTask.exe'
        - 'OneDriveSetup.exe'
        - 'PowerShell.EXE'
        - 'REGSVR32.EXE'
        - 'smss.exe'
        - 'Spotify.exe'
        - 'WerMgr'
filter_main_product:
    Product:
        - 'Avira'
        - 'Evernote'
        - 'Firefox'
        - 'Microsoft Office'
        - 'Ninite'
        - 'Opera Browser Assistant Installer'
        - 'Opera Installer'
        - 'Sysinternals Sysmon'

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
Imagestarts_withC:\Program Files (x86)\excludes:Image field:"Image" value:"C:\Program Files (x86)\"
Imagestarts_withC:\Program Files\excludes:Image field:"Image" value:"C:\Program Files\"
OriginalFileNameeqCmd.Exeexcludes:OriginalFileName field:"OriginalFileName" value:"Cmd.Exe"
OriginalFileNameeqCompatTelRunner.exeexcludes:OriginalFileName field:"OriginalFileName" value:"CompatTelRunner.exe"
OriginalFileNameeqDiscord.exeexcludes:OriginalFileName field:"OriginalFileName" value:"Discord.exe"
OriginalFileNameeqEXPLORER.EXEexcludes:OriginalFileName field:"OriginalFileName" value:"EXPLORER.EXE"
OriginalFileNameeqIE4UINIT.EXEexcludes:OriginalFileName field:"OriginalFileName" value:"IE4UINIT.EXE"
OriginalFileNameeqMpCmdRun.exeexcludes:OriginalFileName field:"OriginalFileName" value:"MpCmdRun.exe"
OriginalFileNameeqNGenTask.exeexcludes:OriginalFileName field:"OriginalFileName" value:"NGenTask.exe"
OriginalFileNameeqOneDriveSetup.exeexcludes:OriginalFileName field:"OriginalFileName" value:"OneDriveSetup.exe"
OriginalFileNameeqPowerShell.EXEexcludes:OriginalFileName field:"OriginalFileName" value:"PowerShell.EXE"
OriginalFileNameeqREGSVR32.EXEexcludes:OriginalFileName field:"OriginalFileName" value:"REGSVR32.EXE"
OriginalFileNameeqSpotify.exeexcludes:OriginalFileName field:"OriginalFileName" value:"Spotify.exe"
OriginalFileNameeqWerMgrexcludes:OriginalFileName field:"OriginalFileName" value:"WerMgr"
OriginalFileNameeqelectron.exeexcludes:OriginalFileName field:"OriginalFileName" value:"electron.exe"
OriginalFileNameeqhttpd.exeexcludes:OriginalFileName field:"OriginalFileName" value:"httpd.exe"
OriginalFileNameeqmmc.exeexcludes:OriginalFileName field:"OriginalFileName" value:"mmc.exe"
OriginalFileNameeqmscorsvw.exeexcludes:OriginalFileName field:"OriginalFileName" value:"mscorsvw.exe"
OriginalFileNameeqmsiexec.exeexcludes:OriginalFileName field:"OriginalFileName" value:"msiexec.exe"
OriginalFileNameeqsmss.exeexcludes:OriginalFileName field:"OriginalFileName" value:"smss.exe"
ProducteqAviraexcludes:Product field:"Product" value:"Avira"
ProducteqEvernoteexcludes:Product field:"Product" value:"Evernote"
ProducteqFirefoxexcludes:Product field:"Product" value:"Firefox"
ProducteqMicrosoft Officeexcludes:Product field:"Product" value:"Microsoft Office"
ProducteqNiniteexcludes:Product field:"Product" value:"Ninite"
ProducteqOpera Browser Assistant Installerexcludes:Product field:"Product" value:"Opera Browser Assistant Installer"
ProducteqOpera Installerexcludes:Product field:"Product" value:"Opera Installer"
ProducteqSysinternals Sysmonexcludes:Product field:"Product" value:"Sysinternals Sysmon"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Imagecross_field_compare
  • ParentImage transforms: op:eq
field:"Image" kind:cross_field_compare value:"ParentImage"