Detection rules › Splunk
Process Creation Using Sysnative Folder (Windows Event Log)
Threat actors may use tools spawning processes from the Sysnative folder in an attempt to bypass the File System Redirector on 64-bit versions of Windows to execute 32-bit applications from the 64-bit system directory. This use cased detects instances where the Sysnative folder is used during process creation, a tactic often associated with CobaltStrike activities. Note: Sysnative is often referenced by legitimate processes. Allowlisting known processes is recommended to reduce false positives.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1218 System Binary Proxy Execution |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '23146.42110'
title: Process Creation Using Sysnative Folder
description: 'Threat actors may use tools spawning processes from the Sysnative folder
in an attempt to bypass the File System Redirector on 64-bit versions of Windows
to execute 32-bit applications from the 64-bit system directory. This use cased
detects instances where the Sysnative folder is used during process creation, a
tactic often associated with CobaltStrike activities. Note: Sysnative is often referenced
by legitimate processes. Allowlisting known processes is recommended to reduce false
positives.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) "Sysnative" | regex process="(?i)^[A-Z]:\x5cWindows\x5cSysnative\x5c"
| table _time, host, user, parent_process_name, process | bin span=1s | stats values(*)
as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
technique_id:
- T1218
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
- https://learn.microsoft.com/sv-se/windows/win32/winprog64/file-system-redirector
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) "Sysnative"
Stage 2: regex
| regex process="(?i)^[A-Z]:\x5cWindows\x5cSysnative\x5c"
Stage 3: table
| table _time, host, user, parent_process_name, process
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | "Sysnative" |