sudo cscli collections install sigmahq/windows_proc_creationThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Hover a line or a note to see what each field does.
name: sigmahq/windows_proc_creationparsers:- crowdsecurity/sysmon-logscontexts:- crowdsecurity/sysmon_basescenarios:- sigmahq/proc_creation_win_addinutil_suspicious_cmdline- sigmahq/proc_creation_win_adplus_memory_dump- sigmahq/proc_creation_win_agentexecutor_susp_usage- sigmahq/proc_creation_win_aspnet_compiler_susp_child_process- sigmahq/proc_creation_win_aspnet_compiler_susp_paths- sigmahq/proc_creation_win_at_interactive_execution- sigmahq/proc_creation_win_attrib_system_susp_paths- sigmahq/proc_creation_win_auditpol_nt_resource_kit_usage- sigmahq/proc_creation_win_auditpol_susp_execution- sigmahq/proc_creation_win_bcdedit_boot_conf_tamper- sigmahq/proc_creation_win_bginfo_suspicious_child_process- sigmahq/proc_creation_win_bitsadmin_download_direct_ip- sigmahq/proc_creation_win_bitsadmin_download_susp_extensions- sigmahq/proc_creation_win_bitsadmin_download_susp_targetfolder- sigmahq/proc_creation_win_browsers_chromium_headless_debugging- sigmahq/proc_creation_win_browsers_chromium_headless_file_download- sigmahq/proc_creation_win_browsers_chromium_mockbin_abuse- sigmahq/proc_creation_win_browsers_chromium_susp_load_extension- sigmahq/proc_creation_win_browsers_tor_execution- sigmahq/proc_creation_win_calc_uncommon_exec- sigmahq/proc_creation_win_certoc_download_direct_ip- sigmahq/proc_creation_win_certoc_load_dll_susp_locations- sigmahq/proc_creation_win_certutil_download_direct_ip- sigmahq/proc_creation_win_certutil_ntlm_coercion- sigmahq/proc_creation_win_citrix_trolleyexpress_procdump- sigmahq/proc_creation_win_cmd_assoc_tamper_exe_file_association- sigmahq/proc_creation_win_cmd_copy_dmp_from_share- sigmahq/proc_creation_win_cmd_curl_download_exec_combo- sigmahq/proc_creation_win_cmdkey_recon- sigmahq/proc_creation_win_cmd_mklink_osk_cmd- sigmahq/proc_creation_win_cmd_mklink_shadow_copies_access_symlink- sigmahq/proc_creation_win_cmd_net_use_and_exec_combo- sigmahq/proc_creation_win_cmd_no_space_execution- sigmahq/proc_creation_win_cmd_ntdllpipe_redirect
Sign in to see the Security Engines that run this collection, the version they run and whether it was modified locally.
This collection is an import from SigmaHQ (core) project rules related to Windows Process Creation.
Release: r2024-11-10
The process creation detection relies on Sysmon.
Example acquisition for this collection:
1source: wineventlog2pretty_name: sysmon3event_channel: "Microsoft-Windows-Sysmon/Operational"4labels:5 type: sysmon