New process reaches System integrity from a non-system parent

Siemphony@siemphonymediumT1134.002unverified

Matches the result AN1253 describes rather than the API call that produces it: a new process whose own IntegrityLevel is System, spawned by a parent that is not one of the process-hosting binaries Windows itself uses to start SYSTEM work. CreateProcessWithTokenW, CreateProcessAsUserW and runas.exe all converge on this same signature regardless of which one was used, which is the point — this rule does not require a runas command line, because that path is already covered separately by T1134.001 in this corpus and repeating it here would double-count the same event under two technique IDs. The filter is MITRE's ParentChildUserMismatch knob turned into an allowlist of parents that legitimately start SYSTEM processes (services.exe, wininit.exe, smss.exe, csrss.exe, winlogon.exe, userinit.exe, lsass.exe, svchost.exe, taskhostw.exe, WmiPrvSE.exe, TrustedInstaller.exe — the last four added because native Windows services hosted in svchost.exe, and the Task Scheduler/WMI/servicing helpers they hand off to, are the single most common legitimate source of System-integrity children on a real endpoint; without them this rule would have alerted on routine OS background activity far louder than any false positive named below); anything else reaching System integrity is the anomaly the analytic asks for. This cannot see IntegrityEscalationDelta as MITRE frames it (a jump measured against the parent's own integrity) because that would require reading the parent's own process_creation event, a cross-event join lib/sigma does not support — the proxy here is coarser: any non-allowlisted parent producing a System-integrity child, not specifically a jump from Medium or Low. The brief also maps this analytic onto Security 4688, but 4688 has no IntegrityLevel field at all — only TokenElevationType, which encodes UAC elevation type, not integrity level — so a 4688-only feed cannot run this rule even with a field mapping; it requires genuine Sysmon EventID 1 telemetry. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0456, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessIntegrityLevel =~ "System" and not ((InitiatingProcessFolderPath endswith "\\services.exe" or InitiatingProcessFolderPath endswith "\\wininit.exe" or InitiatingProcessFolderPath endswith "\\smss.exe" or InitiatingProcessFolderPath endswith "\\csrss.exe" or InitiatingProcessFolderPath endswith "\\winlogon.exe" or InitiatingProcessFolderPath endswith "\\userinit.exe" or InitiatingProcessFolderPath endswith "\\lsass.exe" or InitiatingProcessFolderPath endswith "\\svchost.exe" or InitiatingProcessFolderPath endswith "\\taskhostw.exe" or InitiatingProcessFolderPath endswith "\\WmiPrvSE.exe" or InitiatingProcessFolderPath endswith "\\TrustedInstaller.exe" or InitiatingProcessFolderPath endswith "\\CcmExec.exe" or InitiatingProcessFolderPath endswith "\\Microsoft.Management.Services.IntuneWindowsAgent.exe")))

Splunk · SPL

Run this as a search.

index=* (IntegrityLevel="System" AND NOT ((ParentImage="*\\services.exe" OR ParentImage="*\\wininit.exe" OR ParentImage="*\\smss.exe" OR ParentImage="*\\csrss.exe" OR ParentImage="*\\winlogon.exe" OR ParentImage="*\\userinit.exe" OR ParentImage="*\\lsass.exe" OR ParentImage="*\\svchost.exe" OR ParentImage="*\\taskhostw.exe" OR ParentImage="*\\WmiPrvSE.exe" OR ParentImage="*\\TrustedInstaller.exe" OR ParentImage="*\\CcmExec.exe" OR ParentImage="*\\Microsoft.Management.Services.IntuneWindowsAgent.exe")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(IntegrityLevel) == "system" AND NOT ((TO_LOWER(process.parent.executable) LIKE "*\\\\services.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\wininit.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\smss.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\csrss.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\winlogon.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\userinit.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\lsass.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\svchost.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\taskhostw.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\wmiprvse.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\trustedinstaller.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\ccmexec.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\microsoft.management.services.intunewindowsagent.exe")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="IntegrityLevel" type="pcre2">(?i)^System$</field>    <field name="ParentImage" negate="yes" type="pcre2">(?i)(\\services\.exe$|\\wininit\.exe$|\\smss\.exe$|\\csrss\.exe$|\\winlogon\.exe$|\\userinit\.exe$|\\lsass\.exe$|\\svchost\.exe$|\\taskhostw\.exe$|\\WmiPrvSE\.exe$|\\TrustedInstaller\.exe$|\\CcmExec\.exe$|\\Microsoft\.Management\.Services\.IntuneWindowsAgent\.exe$)</field>    <description>New process reaches System integrity from a non-system parent</description>    <mitre>      <id>T1134.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: process_injection
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 28d6b737-2a7e-4c41-8f46-eeb745612e6c

ATT&CKT1134.002

T1134.002Create Process with Token

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonprocess injection

process injectionAI draft — unreviewed

01 · What this rule detects

MITRE's AN1253 describes a chain: a suspicious command or API duplicates/opens a token, then CreateProcessWithTokenW, CreateProcessAsUserW, or runas spawns a new process whose security context differs from its parent. This rule doesn't follow that chain — lib/sigma has no cross-event join for it — and instead matches the result the chain produces: a new process whose own IntegrityLevel is System, spawned by a parent that isn't one of the binaries Windows itself uses to start SYSTEM work. CreateProcessWithTokenW, CreateProcessAsUserW, and runas.exe all converge on this same signature, which is the point of catching the outcome rather than the mechanism. The rule deliberately does not require a runas command line — that surface is covered separately by T1134.001 in this corpus, and duplicating it here would double-count one event under two technique IDs.

02 · Telemetry you need

Sysmon EventID 1 (process_creation) with IntegrityLevel and ParentImage populated — this is a genuine Sysmon EID1 field even though AUTHORING.md's example field list doesn't name it. The brief also maps AN1253 onto Security 4688, but 4688 has no IntegrityLevel field at all; its TokenElevationType encodes UAC elevation type, a different concept. A 4688-only feed cannot run this rule even with a field mapping — genuine Sysmon telemetry is required.

03 · How the logic works

selection requires IntegrityLevel: 'System'. filter_known_system_parents excludes children of eleven binaries: the original seven Windows process-hosting binaries (services.exe, wininit.exe, smss.exe, csrss.exe, winlogon.exe, userinit.exe, lsass.exe) plus four added during adversarial review — svchost.exe, taskhostw.exe, WmiPrvSE.exe, TrustedInstaller.exe. The condition is selection and not filter_known_system_parents. This allowlist is the pipeline's own construction of MITRE's ParentChildUserMismatch knob, not MITRE's values. The four added binaries matter: svchost.exe hosts most native Windows services (Task Scheduler, WMI, servicing), and without it on the list, every routine SYSTEM-integrity scheduled task would have outfired the rule's own disclosed false positives. This is coarser than MITRE's IntegrityEscalationDelta knob, which frames the signal as a jump measured against the parent's own integrity level — that would need reading the parent's process_creation event, another join this rule doesn't attempt. Instead it treats any non-allowlisted parent producing a System child as the anomaly, regardless of what integrity level that parent held.

04 · Common false positives

Endpoint management, patching, and backup agents that relaunch their own service host at System integrity from a parent binary not on the allowlist — a vendor-installed driver service hosting its own executable rather than svchost.exe is the clearest example. PsExec run with -s produces a System-integrity child parented by the PsExec-installed service binary itself, not services.exe, if that binary's path isn't already allowlisted. Driver installation and hardware-enablement helpers launched from Device Manager or a plug-and-play event legitimately run at System integrity too.

05 · Detection maturity

tier_1: Unverified — never run against a log line. This sits at the lowest DeBMM tier until deployed against real telemetry with the allowlist tuned against the specific endpoint agents present in an environment.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Extend filter_known_system_parents with the specific paths of management/patching/backup agent service binaries and any PsExec-installed service paths used in the estate — these are named, addressable gaps, not vague noise. Because the rule can't measure IntegrityEscalationDelta, expect it to catch legitimate System-spawning software that a delta-aware version would exclude; watch actual match volume before trusting level: medium.

Declared by the author

Endpoint management, patching and backup agents whose updater or repair component relaunches its own service host with System integrity from a parent binary not on the allowlist above (e.g. a vendor-installed driver service hosting its own executable rather than svchost.exe).
PsExec and similar legitimate remote-administration tooling run with the -s (system) flag, which produces a System-integrity child whose immediate parent is the PsExec-installed service binary itself rather than services.exe, if that installed binary's path is not already on the allowlist above.
Driver installation and hardware-enablement helpers that legitimately run with System integrity when launched from Device Manager or a plug-and-play event, if their parent is not one of the allowlisted system-hosting binaries.

Noise checkfires on 2 of 30

Fires on 2 of 30 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pc-backup-reg-save-hives
Backup and system-state tooling exports SAM/SYSTEM/SECURITY hives as part of a bare-metal restore point. Identical command line to credential theft.
pc-installer-schtasks-create
An application installer registering its updater task. Scheduled-task creation is how most software keeps itself current.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 2 false · 100.0% noise

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1134.002, evaluated against their process_creation events.

Share this rule

/u/siemphony/28d6b737-2a7e-4c41-8f46-eeb745612e6c

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

New process reaches System integrity from a non-system parent

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it