Detection rules › Sigma
Process Creation Using Sysnative Folder
Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | |
| Stealth |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
title: Process Creation Using Sysnative Folder
id: 3c1b5fb0-c72f-45ba-abd1-4d4c353144ab
status: test
description: Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)
references:
- https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
author: Max Altgelt (Nextron Systems)
date: 2022-08-23
modified: 2025-10-08
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1055
logsource:
category: process_creation
product: windows
detection:
selection:
- CommandLine|contains: ':\Windows\Sysnative\'
- Image|contains: ':\Windows\Sysnative\'
filter_main_ngen:
Image|contains:
- 'C:\Windows\Microsoft.NET\Framework64\v'
- 'C:\Windows\Microsoft.NET\Framework\v'
- 'C:\Windows\Microsoft.NET\FrameworkArm\v'
- 'C:\Windows\Microsoft.NET\FrameworkArm64\v'
Image|endswith: '\ngen.exe'
CommandLine|contains: 'install'
filter_optional_xampp:
CommandLine|contains|all:
- '"C:\Windows\sysnative\cmd.exe"'
- '\xampp\'
- '\catalina_start.bat'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_* and not 1 of filter_optional_*Stage 1: selection
selection:
- CommandLine|contains: ':\Windows\Sysnative\'
- Image|contains: ':\Windows\Sysnative\'
Stage 2: not filter_main_ngen
filter_main_ngen:
Image|contains:
- 'C:\Windows\Microsoft.NET\Framework64\v'
- 'C:\Windows\Microsoft.NET\Framework\v'
- 'C:\Windows\Microsoft.NET\FrameworkArm\v'
- 'C:\Windows\Microsoft.NET\FrameworkArm64\v'
Image|endswith: '\ngen.exe'
CommandLine|contains: 'install'
Stage 3: not filter_optional_xampp
filter_optional_xampp:
CommandLine|contains|all:
- '"C:\Windows\sysnative\cmd.exe"'
- '\xampp\'
- '\catalina_start.bat'
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Image | match | C:\Windows\Microsoft.NET\Framework64\v | excludes:Image field:"Image" value:"C:\Windows\Microsoft.NET\Framework64\v" |
Image | match | C:\Windows\Microsoft.NET\FrameworkArm64\v | excludes:Image field:"Image" value:"C:\Windows\Microsoft.NET\FrameworkArm64\v" |
Image | match | C:\Windows\Microsoft.NET\FrameworkArm\v | excludes:Image field:"Image" value:"C:\Windows\Microsoft.NET\FrameworkArm\v" |
Image | match | C:\Windows\Microsoft.NET\Framework\v | excludes:Image field:"Image" value:"C:\Windows\Microsoft.NET\Framework\v" |
CommandLine | match | install | excludes:CommandLine field:"CommandLine" value:"install" |
Image | ends_with | \ngen.exe | excludes:Image field:"Image" value:"\ngen.exe" |
CommandLine | match | "C:\Windows\sysnative\cmd.exe" | excludes:CommandLine |
CommandLine | match | \catalina_start.bat | excludes:CommandLine field:"CommandLine" value:"\catalina_start.bat" |
CommandLine | match | \xampp\ | excludes:CommandLine field:"CommandLine" value:"\xampp\" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match value:":\Windows\Sysnative\" |
Image | match |
| field:"Image" kind:match value:":\Windows\Sysnative\" |