Sysinternals PsSuspend Suspicious Execution

calendar Jul 1, 2026 · attack.defense-impairment attack.t1685  ·
Share on: linkedin copy

Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses

Sigma rule (View on GitHub)

 1title: Sysinternals PsSuspend Suspicious Execution
 2id: 4beb6ae0-f85b-41e2-8f18-8668abc8af78
 3related:
 4    - id: 48bbc537-b652-4b4e-bd1d-281172df448f # Basic Execution
 5      type: similar
 6status: test
 7description: Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses
 8references:
 9    - https://learn.microsoft.com/en-us/sysinternals/downloads/pssuspend
10    - https://twitter.com/0gtweet/status/1638069413717975046
11author: Nasreddine Bencherchali (Nextron Systems)
12date: 2023-03-23
13modified: 2026-06-29
14tags:
15    - attack.defense-impairment
16    - attack.t1685
17logsource:
18    category: process_creation
19    product: windows
20detection:
21    selection_img:
22        - OriginalFileName: 'pssuspend.exe'
23        - Image|endswith:
24              - '\pssuspend.exe'
25              - '\pssuspend64.exe'
26              - '\pssuspend64a.exe'
27    selection_cli:
28        # Add more interesting/critical processes
29        CommandLine|contains: 'msmpeng.exe'
30    condition: all of selection_*
31falsepositives:
32    - Unlikely
33level: high

References

Related rules

to-top