[[ fm.text ]] Click here

RRAS service host spawning suspicious child process (CVE-2025-62549)

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Apache-2.0

Detects RRAS svchost spawning a shell or LOLBin as SYSTEM, indicating possible CVE-2025-62549 exploitation.

title: RRAS service host spawning suspicious child process (CVE-2025-62549)
id: c100fb40-10ab-4a81-a3a7-a337d5509786
status: experimental
description: |
  Detects RRAS svchost spawning a shell or LOLBin as SYSTEM, indicating possible CVE-2025-62549 exploitation. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détecte svchost RRAS lançant un shell ou un LOLBin sous SYSTEM, signe possible d'exploitation de CVE-2025-62549. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
related:
  - id: aaa66295-be7b-4392-bc67-a5e3e06cc5b0
    type: similar

author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2025-12-24
modified: 2026-06-21
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-62549
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62549
tags:
  - attack.initial-access
  - attack.execution
  - attack.t1059
  - attack.t1569.002
  - cve.2025-62549
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent_rras:
    # Use contains: non-English Windows reports NT AUTORITE\SYSTÈME etc.; contains 'SYSTEM' is portable.
    # Exact match would silently miss non-English endpoints.
    User|contains: 'SYSTEM'
    ParentImage|endswith: '\svchost.exe'
    ParentCommandLine|contains|all:
      - '-s'
      - 'RemoteAccess'

  selection_child_lolbin:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\msiexec.exe'
      - '\wmic.exe'

  condition: selection_parent_rras and selection_child_lolbin

fields:
  - UtcTime
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - User
  - IntegrityLevel
  - ProcessId
  - ParentProcessId

falsepositives:
  - Rare admin scripts executed in RRAS context (validate service command line and change tickets)
  - Vendor VPN or RRAS management tooling triggering child processes

level: medium

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

ec24aeee-3265-4be0-a611-cea888240efc

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion