Taskmgr as LOCAL_SYSTEM

Title: Taskmgr as LOCAL_SYSTEM
Status: test
Description:Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM
References:
  -Internal Research
Author: Florian Roth (Nextron Systems)
Date: 2018-03-18
modified:2022-05-27
Tags:

• -'attack.stealth'
• -'attack.t1036'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    User|contains:
      -'AUTHORI'
      -'AUTORI'

    Image|endswith: '\taskmgr.exe'
  condition:selection
Falsepositives:
  -Unknown
Level: high