New process reaches System integrity from a non-system parent

1title: New process reaches System integrity from a non-system parent2id: 28d6b737-2a7e-4c41-8f46-eeb745612e6c3status: experimental4description: |5  Matches the result AN1253 describes rather than the API call that produces6  it: a new process whose own IntegrityLevel is System, spawned by a parent7  that is not one of the process-hosting binaries Windows itself uses to start8  SYSTEM work. CreateProcessWithTokenW, CreateProcessAsUserW and runas.exe all9  converge on this same signature regardless of which one was used, which is10  the point — this rule does not require a runas command line, because that11  path is already covered separately by T1134.001 in this corpus and repeating12  it here would double-count the same event under two technique IDs. The13  filter is MITRE's ParentChildUserMismatch knob turned into an allowlist of14  parents that legitimately start SYSTEM processes (services.exe, wininit.exe,15  smss.exe, csrss.exe, winlogon.exe, userinit.exe, lsass.exe, svchost.exe,16  taskhostw.exe, WmiPrvSE.exe, TrustedInstaller.exe — the last four added17  because native Windows services hosted in svchost.exe, and the Task18  Scheduler/WMI/servicing helpers they hand off to, are the single most common19  legitimate source of System-integrity children on a real endpoint; without20  them this rule would have alerted on routine OS background activity far21  louder than any false positive named below); anything else reaching System22  integrity is the anomaly the analytic asks for. This cannot23  see IntegrityEscalationDelta as MITRE frames it (a jump measured against the24  parent's own integrity) because that would require reading the parent's own25  process_creation event, a cross-event join lib/sigma does not support — the26  proxy here is coarser: any non-allowlisted parent producing a System-integrity27  child, not specifically a jump from Medium or Low. The brief also maps this28  analytic onto Security 4688, but 4688 has no IntegrityLevel field at all —29  only TokenElevationType, which encodes UAC elevation type, not integrity30  level — so a 4688-only feed cannot run this rule even with a field mapping;31  it requires genuine Sysmon EventID 1 telemetry.32  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0456, not hand-written and not tested by its author. Any lab result is on this rule's own page.33references:34  - https://attack.mitre.org/techniques/T1134/00235  - https://attack.mitre.org/detectionstrategies/DET045636author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)37date: 2026-08-1738tags:39  - attack.defense-evasion40  - attack.privilege-escalation41  - attack.t1134.00242logsource:43  category: process_creation44  product: windows45detection:46  selection:47    IntegrityLevel: 'System'48  filter_known_system_parents:49    ParentImage|endswith:50      - '\services.exe'51      - '\wininit.exe'52      - '\smss.exe'53      - '\csrss.exe'54      - '\winlogon.exe'55      - '\userinit.exe'56      - '\lsass.exe'57      - '\svchost.exe'58      - '\taskhostw.exe'59      - '\WmiPrvSE.exe'60      - '\TrustedInstaller.exe'61      # Microsoft's own management agents, on stable in-box paths. Both host62      # SYSTEM-integrity children by design and sit on virtually every managed63      # Windows estate, so their absence made this the loudest rule in the64      # corpus against a benign baseline — it fired on ordinary ConfigMgr and65      # Intune script execution. Same intent as the entries above: things that66      # legitimately host a SYSTEM process.67      - '\CcmExec.exe'68      - '\Microsoft.Management.Services.IntuneWindowsAgent.exe'69  condition: selection and not filter_known_system_parents70falsepositives:71  - "Endpoint management, patching and backup agents whose updater or repair component relaunches its own service host with System integrity from a parent binary not on the allowlist above (e.g. a vendor-installed driver service hosting its own executable rather than svchost.exe)."72  - "PsExec and similar legitimate remote-administration tooling run with the -s (system) flag, which produces a System-integrity child whose immediate parent is the PsExec-installed service binary itself rather than services.exe, if that installed binary's path is not already on the allowlist above."73  - "Driver installation and hardware-enablement helpers that legitimately run with System integrity when launched from Device Manager or a plug-and-play event, if their parent is not one of the allowlisted system-hosting binaries."74level: medium