Sysinternals PsSuspend Execution

calendar Jul 1, 2026 · attack.privilege-escalation attack.discovery attack.persistence attack.t1543.003  ·
Share on: linkedin copy

Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes

Sigma rule (View on GitHub)

 1title: Sysinternals PsSuspend Execution
 2id: 48bbc537-b652-4b4e-bd1d-281172df448f
 3related:
 4    - id: 4beb6ae0-f85b-41e2-8f18-8668abc8af78
 5      type: similar
 6status: test
 7description: Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes
 8references:
 9    - https://learn.microsoft.com/en-us/sysinternals/downloads/pssuspend
10    - https://twitter.com/0gtweet/status/1638069413717975046
11author: Nasreddine Bencherchali (Nextron Systems)
12date: 2023-03-23
13modified: 2026-06-29
14tags:
15    - attack.privilege-escalation
16    - attack.discovery
17    - attack.persistence
18    - attack.t1543.003
19logsource:
20    category: process_creation
21    product: windows
22detection:
23    selection:
24        - OriginalFileName: 'pssuspend.exe'
25        - Image|endswith:
26              - '\pssuspend.exe'
27              - '\pssuspend64.exe'
28              - '\pssuspend64a.exe'
29    condition: selection
30falsepositives:
31    - Unknown
32level: medium

References

Related rules

to-top