Suspicious Cross-User Process Spawn

SIGMA detection rule by Swachchhanda Shrawan Poudel (Nextron Systems) · Unknown

Detects suspicious spawning of a process under a different user context than the parent process. Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.

title: Suspicious Cross-User Process Spawn
id: d2b7a134-9c3e-4f8a-b56d-e0c1f8a29b47
status: experimental
description: |
    Detects suspicious spawning of a process under a different user context than the parent process.
    Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and
    also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.
references:
    - https://github.com/MSNightmare/LegacyHive
    - https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-07-23
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055
    - attack.t1134
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\notepad.exe'
            - '\calc.exe'
            - '\mspaint.exe'
            - '\wordpad.exe'
            - '\write.exe'
    filter_main_same_user:
        User|fieldref: ParentUser
    filter_optional_user_null:
        User: null
    filter_optional_parent_null:
        ParentUser: null
    filter_optional_empty_user:
        - ParentUser:
              - ''
              - '-'
        - User:
              - ''
              - '-'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - RunAs usage spawning one of the listed binaries under a different account
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_cross_user_process_spawn/info.yml

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

9a4fb3bb-21be-4a53-affd-45ca7aaeaa25

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion