Core system binary started by an unexpected parent

Siemphony@siemphonymediumT1055.012unverified

AN1076 describes the hollowing sequence — CreateProcess with CREATE_SUSPENDED, NtUnmapViewOfSection, VirtualAllocEx and WriteProcessMemory, then SetThreadContext and ResumeThread — and none of the three log sources in the strategy carries any step of it. Sysmon EventID 1 has no field for process creation flags, so the suspended start is invisible; EventID 10 does not fire because the injector creates the victim itself and already holds the handle, so it never calls OpenProcess; EventID 8 does not fire because execution resumes the child's existing primary thread rather than creating a remote one. What remains observable is the decoy itself, which is what MITRE's HollowedImageNamePattern knob points at, populated here not with a name list but with the small set of Windows binaries that have exactly one legitimate creator — svchost.exe and spoolsv.exe come from services.exe, lsass.exe and services.exe from wininit.exe, csrss.exe, wininit.exe and winlogon.exe from smss.exe — so any other parent is an anomaly on its face. The rule is written in Sysmon EventID 1 vocabulary (Image, ParentImage); on Security 4688 the equivalent fields are NewProcessName and ParentProcessName and Audit Process Creation must be enabled first, a mapping this rule does not carry. Prerequisite: Sysmon is not present in a default install. Two limits are structural: a hit is evidence of an anomalous launch, not of hollowing — masquerading under a system binary name produces the identical event — and a hollowed process created under a plausible parent, or hollowed into a decoy outside this list, is missed entirely. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0382, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\svchost.exe" or FolderPath endswith "\\spoolsv.exe" or FolderPath endswith "\\lsass.exe" or FolderPath endswith "\\services.exe" or FolderPath endswith "\\csrss.exe" or FolderPath endswith "\\wininit.exe" or FolderPath endswith "\\winlogon.exe") and not ((InitiatingProcessFolderPath endswith "\\services.exe" or InitiatingProcessFolderPath endswith "\\wininit.exe" or InitiatingProcessFolderPath endswith "\\smss.exe")))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\svchost.exe" OR Image="*\\spoolsv.exe" OR Image="*\\lsass.exe" OR Image="*\\services.exe" OR Image="*\\csrss.exe" OR Image="*\\wininit.exe" OR Image="*\\winlogon.exe") AND NOT ((ParentImage="*\\services.exe" OR ParentImage="*\\wininit.exe" OR ParentImage="*\\smss.exe")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\svchost.exe" OR TO_LOWER(process.executable) LIKE "*\\\\spoolsv.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lsass.exe" OR TO_LOWER(process.executable) LIKE "*\\\\services.exe" OR TO_LOWER(process.executable) LIKE "*\\\\csrss.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wininit.exe" OR TO_LOWER(process.executable) LIKE "*\\\\winlogon.exe") AND NOT ((TO_LOWER(process.parent.executable) LIKE "*\\\\services.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\wininit.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\smss.exe")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\svchost\.exe$|\\spoolsv\.exe$|\\lsass\.exe$|\\services\.exe$|\\csrss\.exe$|\\wininit\.exe$|\\winlogon\.exe$)</field>    <field name="ParentImage" negate="yes" type="pcre2">(?i)(\\services\.exe$|\\wininit\.exe$|\\smss\.exe$)</field>    <description>Core system binary started by an unexpected parent</description>    <mitre>      <id>T1055.012</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: process_injection
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 84eba238-f158-439f-bd5b-cc15136519c7

ATT&CKT1055.012

T1055.012Process Hollowing

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonprocess injection

process injectionAI draft — unreviewed

01 · What this rule detects

AN1076 describes the whole hollowing sequence — CreateProcess with CREATE_SUSPENDED, NtUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, SetThreadContext, ResumeThread — and none of the three log sources in DET0382 records any step of it. That is the first thing to understand about this rule: it does not detect hollowing. It detects the decoy. A hit means a core Windows system binary started under a parent that never legitimately starts it. Hollowing explains that; so does a masquerade that merely borrows the file name. The rule cannot tell them apart.

02 · Telemetry you need

Sysmon EventID 1, as category: process_creation / product: windows, copied verbatim from AN1076. Sysmon is not present in a default install, so on an unequipped estate the rule returns zero rows and zero rows reads as quiet when it means blind.
The rule is written in Sysmon vocabulary — Image, ParentImage. Security 4688 carries the same idea under NewProcessName and ParentProcessName and needs Audit Process Creation enabled; that is a field mapping this rule does not carry, not a drop-in second feed.
The strategy's other two sources are unusable here. EventID 10 never fires because the injector creates the victim itself and already holds the handle, so it never calls OpenProcess. EventID 8 never fires because execution resumes the child's existing primary thread rather than creating a remote one.

03 · How the logic works

Two blocks. selection matches Image|endswith against seven names — svchost.exe, spoolsv.exe, lsass.exe, services.exe, csrss.exe, wininit.exe, winlogon.exe. filter_parent matches ParentImage|endswith against services.exe, wininit.exe, smss.exe. The condition is selection and not filter_parent. The seven names are chosen on one property: each has exactly one legitimate creator. svchost and spoolsv come from services.exe; lsass and services from wininit.exe; csrss, wininit and winlogon from smss.exe. Subtract the three real creators and what is left is, on its face, anomalous. MITRE's HollowedImageNamePattern knob names svchost.exe and notepad.exe. The first is here; the second is deliberately absent, because a user-launched notepad has no fixed parent and no subtraction is possible. The seven-name list is the pipeline's own substitution for MITRE's pattern, not MITRE's list — and it excludes every .NET-host decoy seen in the wild (RegAsm, MSBuild, AppLaunch, vbc). Note also that both blocks match file names, not paths.

04 · Common false positives

Windows container hosts dominate: every container start brings up wininit, services, csrss and svchost under the runtime rather than the usual creator. Windows Sandbox, VDI and session brokers do the same at smaller volume. Then administrators hand-restarting a wedged spooler from an elevated console, and third-party software shipping its own spoolsv.exe under Program Files — that last one is purely the missing path constraint.
One case the rule's own false positives miss: session smss.exe exits within milliseconds, and where Sysmon cannot resolve a dead parent it emits a blank ParentImage, which does not match filter_parent. Every interactive logon may alert.

05 · Detection maturity

tier_1: , and it stays there until it has been run against real data. It is derived from a scaffold that ships no query logic and has never seen a log line.
tier_2: run read-only for two weeks, rank hits by `ParentImage`, and build the exclusion block from the top of that list.
tier_3: ** pair it with a memory-write or unbacked-execution signal so an alert means hollowing rather than an odd launch.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add Image|contains: '\Windows\System32\' to selection. It keeps the case
Pin filter_parent to full System32 paths. As written, a loader named
Exclude the container runtime's ParentImage before deploying on such a
Check how ParentImage renders for csrss and winlogon on a live host; if it

Declared by the author

Windows container hosts, where every container start brings up wininit.exe, services.exe, csrss.exe and svchost.exe under the container runtime rather than under the usual creator. On such a host this is the highest-volume match by a wide margin and needs a ParentImage exclusion for the runtime before the rule is usable at all. This is what sets the level.
Administrators and support scripts troubleshooting a wedged service by hand, for example launching svchost.exe with a service group from an elevated console or restarting the print spooler out of band, which puts cmd.exe or a shell under ParentImage.
Third-party software that ships a binary with one of these file names in its own directory and starts it from a vendor updater or service wrapper; the match is on file name, not on path, so a bundled spoolsv.exe or services.exe under Program Files matches the same way the real one would.
Imaging, sysprep and OS-deployment tooling, plus nested-session hosts such as Windows Sandbox and remote-desktop session brokers, all of which start session-level system processes from a launcher of their own.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1055.012, evaluated against their process_creation events.

Share this rule

/u/siemphony/84eba238-f158-439f-bd5b-cc15136519c7

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Core system binary started by an unexpected parent

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it