Elevated System Shell Spawned

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. Use this rule to hunt for potential suspicious processes.

View on GitHub Open raw file

Detection logic

selection_shell

- Image|endswith:
    - \powershell.exe
    - \powershell_ise.exe
    - \pwsh.exe
    - \cmd.exe
- OriginalFileName:
    - PowerShell.EXE
    - powershell_ise.EXE
    - pwsh.dll
    - Cmd.Exe

selection_user

User|contains:
  - AUTHORI
  - AUTORI
LogonId: "0x3e7"

filter_main_svchost

ParentImage|endswith: \svchost.exe

filter_main_silcollector

ParentImage|endswith: \cmd.exe
ParentCommandLine: C:\Windows\system32\cmd.exe /d /c C:\Windows\system32\silcollector.cmd configure

Condition

all of selection_* and not 1 of filter_*

Raw YAML

title: Elevated System Shell Spawned
id: 61065c72-5d7d-44ef-bf41-6a36684b545f
related:
    - id: 178e615d-e666-498b-9630-9ed363038101
      type: similar
status: test
description: |
    Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. Use this rule to hunt for potential suspicious processes.
references:
    - https://github.com/Wh04m1001/SysmonEoP
author: Nasreddine Bencherchali (Nextron Systems), frack113
date: 2023-11-23
modified: 2026-09-15
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.t1059
    - detection.threat-hunting
logsource:
    product: windows
    category: process_creation
detection:
    selection_shell:
        - Image|endswith:
              - '\powershell.exe'
              - '\powershell_ise.exe'
              - '\pwsh.exe'
              - '\cmd.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'powershell_ise.EXE'
              - 'pwsh.dll'
              - 'Cmd.Exe'
    selection_user:
        User|contains: # covers many language settings
            - 'AUTHORI'
            - 'AUTORI'
        LogonId: '0x3e7'
    filter_main_svchost:
        ParentImage|endswith: '\svchost.exe'
    filter_main_silcollector:
        ParentImage|endswith: '\cmd.exe'
        ParentCommandLine: 'C:\Windows\system32\cmd.exe /d /c C:\Windows\system32\silcollector.cmd configure'
    condition: all of selection_* and not 1 of filter_*
falsepositives:
    - Unknown
level: medium