Suspicious Cross-User Process Spawn

 1title: Suspicious Cross-User Process Spawn
 2id: d2b7a134-9c3e-4f8a-b56d-e0c1f8a29b47
 3status: experimental
 4description: |
 5    Detects suspicious spawning of a process under a different user context than the parent process.
 6    Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and
 7    also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.    
 8references:
 9    - https://github.com/MSNightmare/LegacyHive
10    - https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive
11author: Swachchhanda Shrawan Poudel (Nextron Systems)
12date: 2026-07-23
13tags:
14    - attack.privilege-escalation
15    - attack.stealth
16    - attack.t1055
17    - attack.t1134
18logsource:
19    category: process_creation
20    product: windows
21detection:
22    selection:
23        Image|endswith:
24            - '\notepad.exe'
25            - '\calc.exe'
26            - '\mspaint.exe'
27            - '\wordpad.exe'
28            - '\write.exe'
29    filter_main_same_user:
30        User|fieldref: ParentUser
31    filter_optional_user_null:
32        User: null
33    filter_optional_parent_null:
34        ParentUser: null
35    filter_optional_empty_user:
36        - ParentUser:
37              - ''
38              - '-'
39        - User:
40              - ''
41              - '-'
42    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
43falsepositives:
44    - RunAs usage spawning one of the listed binaries under a different account
45level: medium
46regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_cross_user_process_spawn/info.yml