Suspicious Sysmon as Execution Parent

title: Suspicious Sysmon as Execution Parent
id: 6d1058a4-407e-4f3a-a144-1968c11dc5c3
status: test
description: Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41120
    - https://twitter.com/filip_dragovic/status/1590052248260055041
    - https://twitter.com/filip_dragovic/status/1590104354727436290
author: Florian Roth (Nextron Systems), Tim Shelton (fp werfault)
date: 2022-11-10
modified: 2025-07-04
tags:
    - attack.privilege-escalation
    - attack.t1068
    - cve.2022-41120
    - detection.emerging-threats
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith:
            - '\Sysmon.exe'
            - '\Sysmon64.exe'
    filter_main_temp_sysmon:
        # C:\Users\ADMINI~1\AppData\Local\Temp\2\Sysmon.exe
        Image|startswith: 'C:\Users\'
        Image|contains: '\AppData\Local\Temp\'
        Image|endswith:
            - '\Sysmon.exe'
            - '\Sysmon64.exe'
    filter_main_generic:
        Image|contains:
            - ':\Windows\Sysmon.exe'
            - ':\Windows\Sysmon64.exe'
            - ':\Windows\System32\conhost.exe'
            - ':\Windows\System32\WerFault.exe' # When Sysmon crashes
            - ':\Windows\System32\WerFaultSecure.exe' # When Sysmon crashes
            - ':\Windows\System32\wevtutil.exe'
            - ':\Windows\SysWOW64\wevtutil.exe'
    filter_main_null:
        Image: null
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high