New Process Created Via Taskmgr.EXE

Title: New Process Created Via Taskmgr.EXE
Status: test
Description:Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC
References:
  -https://twitter.com/ReneFreingruber/status/1172244989335810049
Author: Florian Roth (Nextron Systems)
Date: 2018-03-13
modified:2024-01-18
Tags:

• -'attack.stealth'
• -'attack.t1036'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith: '\taskmgr.exe'
  filter_main_generic:
    Image|endswith:
      -':\Windows\System32\mmc.exe'
      -':\Windows\System32\resmon.exe'
      -':\Windows\System32\Taskmgr.exe'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Administrative activity
Level: low