[[ fm.text ]] Click here

Windows successful privilege escalation to SYSTEM via EoP pattern (CVE-2026-20822)

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Apache-2.0

User-land parent spawns SYSTEM/High-integrity child process; strong EoP exploitation indicator (CVE-2026-20822).

title: Windows successful privilege escalation to SYSTEM via EoP pattern (CVE-2026-20822)
id: 2f4d9c88-6bcb-4a9e-9d53-3a8d1a8e2002
status: experimental
description: |
  User-land parent spawns SYSTEM/High-integrity child process; strong EoP exploitation indicator (CVE-2026-20822). SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détecte un processus SYSTEM ou à haute intégrité lancé par un parent utilisateur, indicateur fort d’élévation de privilèges compatible avec la CVE-2026-20822. L’événement ne prouve pas seul la vulnérabilité exploitée. Le SOC L1 doit vérifier les images, les utilisateurs, les niveaux d’intégrité, les lignes de commande et la chronologie.
related:
  - id: 6a3f1e12-9d41-4c9f-b6e1-0b8a2c2b1001
    type: similar

author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-01-22
modified: 2026-06-21
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-20822
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20822
tags:
  - attack.privilege-escalation
  - attack.t1068
  - cve.2026-20822
logsource:
  product: windows
  category: process_creation

detection:
  # SECOND CHALLENGE 2026-06-21: added net.exe and net1.exe (used for user/group manipulation
  # post-EoP), msiexec.exe (silent installer for backdoor dropping), and certutil.exe
  # (download LOLBin commonly used in post-exploitation stagers).
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\schtasks.exe'
      - '\sc.exe'
      - '\reg.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\msiexec.exe'
      - '\certutil.exe'

  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\acrord32.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'

  # Child runs as SYSTEM OR at High/System integrity level
  selection_elevated_system:
    User|contains: 'NT AUTHORITY\SYSTEM'

  selection_elevated_integrity:
    IntegrityLevel:
      - 'High'
      - 'System'

  # Exclude processes whose parents are genuinely privileged by design
  filter_main_privileged_parents:
    ParentImage|endswith:
      - '\services.exe'
      - '\svchost.exe'
      - '\wmiprvse.exe'
      - '\msiexec.exe'
      - '\TiWorker.exe'
      - '\TrustedInstaller.exe'

  # BLIND SPOT FIX 2026-06-21: consent.exe (UAC broker) legitimately spawns High-integrity children
  # when a user approves an elevation prompt. Without this filter, every UAC-elevated executable
  # from a user-land parent would match. Added to avoid FP storm on UAC-consented operations.
  filter_main_uac_consent:
    ParentImage|endswith: '\consent.exe'

  # WerFault.exe can briefly appear as High-integrity after a crash of an elevated process
  filter_main_werfault:
    Image|endswith: '\WerFault.exe'

  condition: selection_child and selection_parent and (selection_elevated_system or selection_elevated_integrity) and not (filter_main_privileged_parents or filter_main_uac_consent or filter_main_werfault)

falsepositives:
  - Legitimate EDR or IR tooling
  - Authorized IT administrative operations
  - UAC-consented elevation from user-land parent (consent.exe path, now filtered)
  - WerFault.exe launched at High integrity after an elevated process crash (now filtered)

fields:
  - UtcTime
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - User
  - IntegrityLevel
  - ProcessId
  - ParentProcessId

level: high

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

cce803a3-a4d2-4f9a-a026-fcb74f087d75

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion