cscli scenarios install sigmahq/proc_creation_win_sysinternals_psexec_paexec_escalate_system1type: trigger2name: sigmahq/proc_creation_win_sysinternals_psexec_paexec_escalate_system3description: |4 Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.CommandLine contains ' -s cmd' || evt.Parsed.CommandLine contains ' /s cmd' || evt.Parsed.CommandLine contains ' –s cmd' || evt.Parsed.CommandLine contains ' —s cmd' || evt.Parsed.CommandLine contains ' ―s cmd' || evt.Parsed.CommandLine contains ' -s -i cmd' || evt.Parsed.CommandLine contains ' -s /i cmd' || evt.Parsed.CommandLine contains ' -s –i cmd' || evt.Parsed.CommandLine contains ' -s —i cmd' || evt.Parsed.CommandLine contains ' -s ―i cmd' || evt.Parsed.CommandLine contains ' /s -i cmd' || evt.Parsed.CommandLine contains ' /s /i cmd' || evt.Parsed.CommandLine contains ' /s –i cmd' || evt.Parsed.CommandLine contains ' /s —i cmd' || evt.Parsed.CommandLine contains ' /s ―i cmd' || evt.Parsed.CommandLine contains ' –s -i cmd' || evt.Parsed.CommandLine contains ' –s /i cmd' || evt.Parsed.CommandLine contains ' –s –i cmd' || evt.Parsed.CommandLine contains ' –s —i cmd' || evt.Parsed.CommandLine contains ' –s ―i cmd' || evt.Parsed.CommandLine contains ' —s -i cmd' || evt.Parsed.CommandLine contains ' —s /i cmd' || evt.Parsed.CommandLine contains ' —s –i cmd' || evt.Parsed.CommandLine contains ' —s —i cmd' || evt.Parsed.CommandLine contains ' —s ―i cmd' || evt.Parsed.CommandLine contains ' ―s -i cmd' || evt.Parsed.CommandLine contains ' ―s /i cmd' || evt.Parsed.CommandLine contains ' ―s –i cmd' || evt.Parsed.CommandLine contains ' ―s —i cmd' || evt.Parsed.CommandLine contains ' ―s ―i cmd' || evt.Parsed.CommandLine contains ' -i -s cmd' || evt.Parsed.CommandLine contains ' -i /s cmd' || evt.Parsed.CommandLine contains ' -i –s cmd' || evt.Parsed.CommandLine contains ' -i —s cmd' || evt.Parsed.CommandLine contains ' -i ―s cmd' || evt.Parsed.CommandLine contains ' /i -s cmd' || evt.Parsed.CommandLine contains ' /i /s cmd' || evt.Parsed.CommandLine contains ' /i –s cmd' || evt.Parsed.CommandLine contains ' /i —s cmd' || evt.Parsed.CommandLine contains ' /i ―s cmd' || evt.Parsed.CommandLine contains ' –i -s cmd' || evt.Parsed.CommandLine contains ' –i /s cmd' || evt.Parsed.CommandLine contains ' –i –s cmd' || evt.Parsed.CommandLine contains ' –i —s cmd' || evt.Parsed.CommandLine contains ' –i ―s cmd' || evt.Parsed.CommandLine contains ' —i -s cmd' || evt.Parsed.CommandLine contains ' —i /s cmd' || evt.Parsed.CommandLine contains ' —i –s cmd' || evt.Parsed.CommandLine contains ' —i —s cmd' || evt.Parsed.CommandLine contains ' —i ―s cmd' || evt.Parsed.CommandLine contains ' ―i -s cmd' || evt.Parsed.CommandLine contains ' ―i /s cmd' || evt.Parsed.CommandLine contains ' ―i –s cmd' || evt.Parsed.CommandLine contains ' ―i —s cmd' || evt.Parsed.CommandLine contains ' ―i ―s cmd' || evt.Parsed.CommandLine contains ' -s pwsh' || evt.Parsed.CommandLine contains ' /s pwsh' || evt.Parsed.CommandLine contains ' –s pwsh' || evt.Parsed.CommandLine contains ' —s pwsh' || evt.Parsed.CommandLine contains ' ―s pwsh' || evt.Parsed.CommandLine contains ' -s -i pwsh' || evt.Parsed.CommandLine contains ' -s /i pwsh' || evt.Parsed.CommandLine contains ' -s –i pwsh' || evt.Parsed.CommandLine contains ' -s —i pwsh' || evt.Parsed.CommandLine contains ' -s ―i pwsh' || evt.Parsed.CommandLine contains ' /s -i pwsh' || evt.Parsed.CommandLine contains ' /s /i pwsh' || evt.Parsed.CommandLine contains ' /s –i pwsh' || evt.Parsed.CommandLine contains ' /s —i pwsh' || evt.Parsed.CommandLine contains ' /s ―i pwsh' || evt.Parsed.CommandLine contains ' –s -i pwsh' || evt.Parsed.CommandLine contains ' –s /i pwsh' || evt.Parsed.CommandLine contains ' –s –i pwsh' || evt.Parsed.CommandLine contains ' –s —i pwsh' || evt.Parsed.CommandLine contains ' –s ―i pwsh' || evt.Parsed.CommandLine contains ' —s -i pwsh' || evt.Parsed.CommandLine contains ' —s /i pwsh' || evt.Parsed.CommandLine contains ' —s –i pwsh' || evt.Parsed.CommandLine contains ' —s —i pwsh' || evt.Parsed.CommandLine contains ' —s ―i pwsh' || evt.Parsed.CommandLine contains ' ―s -i pwsh' || evt.Parsed.CommandLine contains ' ―s /i pwsh' || evt.Parsed.CommandLine contains ' ―s –i pwsh' || evt.Parsed.CommandLine contains ' ―s —i pwsh' || evt.Parsed.CommandLine contains ' ―s ―i pwsh' || evt.Parsed.CommandLine contains ' -i -s pwsh' || evt.Parsed.CommandLine contains ' -i /s pwsh' || evt.Parsed.CommandLine contains ' -i –s pwsh' || evt.Parsed.CommandLine contains ' -i —s pwsh' || evt.Parsed.CommandLine contains ' -i ―s pwsh' || evt.Parsed.CommandLine contains ' /i -s pwsh' || evt.Parsed.CommandLine contains ' /i /s pwsh' || evt.Parsed.CommandLine contains ' /i –s pwsh' || evt.Parsed.CommandLine contains ' /i —s pwsh' || evt.Parsed.CommandLine contains ' /i ―s pwsh' || evt.Parsed.CommandLine contains ' –i -s pwsh' || evt.Parsed.CommandLine contains ' –i /s pwsh' || evt.Parsed.CommandLine contains ' –i –s pwsh' || evt.Parsed.CommandLine contains ' –i —s pwsh' || evt.Parsed.CommandLine contains ' –i ―s pwsh' || evt.Parsed.CommandLine contains ' —i -s pwsh' || evt.Parsed.CommandLine contains ' —i /s pwsh' || evt.Parsed.CommandLine contains ' —i –s pwsh' || evt.Parsed.CommandLine contains ' —i —s pwsh' || evt.Parsed.CommandLine contains ' —i ―s pwsh' || evt.Parsed.CommandLine contains ' ―i -s pwsh' || evt.Parsed.CommandLine contains ' ―i /s pwsh' || evt.Parsed.CommandLine contains ' ―i –s pwsh' || evt.Parsed.CommandLine contains ' ―i —s pwsh' || evt.Parsed.CommandLine contains ' ―i ―s pwsh' || evt.Parsed.CommandLine contains ' -s powershell' || evt.Parsed.CommandLine contains ' /s powershell' || evt.Parsed.CommandLine contains ' –s powershell' || evt.Parsed.CommandLine contains ' —s powershell' || evt.Parsed.CommandLine contains ' ―s powershell' || evt.Parsed.CommandLine contains ' -s -i powershell' || evt.Parsed.CommandLine contains ' -s /i powershell' || evt.Parsed.CommandLine contains ' -s –i powershell' || evt.Parsed.CommandLine contains ' -s —i powershell' || evt.Parsed.CommandLine contains ' -s ―i powershell' || evt.Parsed.CommandLine contains ' /s -i powershell' || evt.Parsed.CommandLine contains ' /s /i powershell' || evt.Parsed.CommandLine contains ' /s –i powershell' || evt.Parsed.CommandLine contains ' /s —i powershell' || evt.Parsed.CommandLine contains ' /s ―i powershell' || evt.Parsed.CommandLine contains ' –s -i powershell' || evt.Parsed.CommandLine contains ' –s /i powershell' || evt.Parsed.CommandLine contains ' –s –i powershell' || evt.Parsed.CommandLine contains ' –s —i powershell' || evt.Parsed.CommandLine contains ' –s ―i powershell' || evt.Parsed.CommandLine contains ' —s -i powershell' || evt.Parsed.CommandLine contains ' —s /i powershell' || evt.Parsed.CommandLine contains ' —s –i powershell' || evt.Parsed.CommandLine contains ' —s —i powershell' || evt.Parsed.CommandLine contains ' —s ―i powershell' || evt.Parsed.CommandLine contains ' ―s -i powershell' || evt.Parsed.CommandLine contains ' ―s /i powershell' || evt.Parsed.CommandLine contains ' ―s –i powershell' || evt.Parsed.CommandLine contains ' ―s —i powershell' || evt.Parsed.CommandLine contains ' ―s ―i powershell' || evt.Parsed.CommandLine contains ' -i -s powershell' || evt.Parsed.CommandLine contains ' -i /s powershell' || evt.Parsed.CommandLine contains ' -i –s powershell' || evt.Parsed.CommandLine contains ' -i —s powershell' || evt.Parsed.CommandLine contains ' -i ―s powershell' || evt.Parsed.CommandLine contains ' /i -s powershell' || evt.Parsed.CommandLine contains ' /i /s powershell' || evt.Parsed.CommandLine contains ' /i –s powershell' || evt.Parsed.CommandLine contains ' /i —s powershell' || evt.Parsed.CommandLine contains ' /i ―s powershell' || evt.Parsed.CommandLine contains ' –i -s powershell' || evt.Parsed.CommandLine contains ' –i /s powershell' || evt.Parsed.CommandLine contains ' –i –s powershell' || evt.Parsed.CommandLine contains ' –i —s powershell' || evt.Parsed.CommandLine contains ' –i ―s powershell' || evt.Parsed.CommandLine contains ' —i -s powershell' || evt.Parsed.CommandLine contains ' —i /s powershell' || evt.Parsed.CommandLine contains ' —i –s powershell' || evt.Parsed.CommandLine contains ' —i —s powershell' || evt.Parsed.CommandLine contains ' —i ―s powershell' || evt.Parsed.CommandLine contains ' ―i -s powershell' || evt.Parsed.CommandLine contains ' ―i /s powershell' || evt.Parsed.CommandLine contains ' ―i –s powershell' || evt.Parsed.CommandLine contains ' ―i —s powershell' || evt.Parsed.CommandLine contains ' ―i ―s powershell') && (evt.Parsed.CommandLine contains 'psexec' || evt.Parsed.CommandLine contains 'paexec' || evt.Parsed.CommandLine contains 'accepteula'))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t1587.0011516 label: "PsExec/PAExec Escalation to LOCAL SYSTEM"17 behavior : "windows:audit"18 remediation: false1920scope:21 type: ParentProcessId22 expression: evt.Parsed.ParentProcessId2324