Skip to content

Hide Navigation Hide TOC

Suspicious SYSTEM User Process Creation (2617e7ed-adb7-40ba-b0f3-8f9945fe6c09)

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Cluster A Galaxy A Cluster B Galaxy B Level
Suspicious SYSTEM User Process Creation (2617e7ed-adb7-40ba-b0f3-8f9945fe6c09) Sigma-Rules Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a) Attack Pattern 1
Suspicious SYSTEM User Process Creation (2617e7ed-adb7-40ba-b0f3-8f9945fe6c09) Sigma-Rules Access Token Manipulation - T1134 (dcaa092b-7de9-4a21-977f-7fcb77e89c48) Attack Pattern 1
Suspicious SYSTEM User Process Creation (2617e7ed-adb7-40ba-b0f3-8f9945fe6c09) Sigma-Rules OS Credential Dumping - T1003 (0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22) Attack Pattern 1