Suspicious Userinit Child Process

Title: Suspicious Userinit Child Process
Status: test
Description:Detects a suspicious child process of userinit
References:
  -https://twitter.com/SBousseaden/status/1139811587760562176
Author: Florian Roth (Nextron Systems), Samir Bousseaden (idea)
Date: 2019-06-17
modified:2025-10-17
Tags:

• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1055'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith: '\userinit.exe'
  filter_main_netlogon:
    CommandLine|contains: '\netlogon\'
  filter_main_explorer:
Image|endswith:'\explorer.exe' OriginalFileName:'explorer.exe' CommandLine:'C:\Windows\Explorer.EXE'   filter_main_null:
    Image: 'None'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Administrative scripts
Level: medium