Uncommon Userinit Child Process
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND PARENTPROCESSNAME endswith "\userinit.exe" AND PROCESSNAME notendswith ":\WINDOWS\explorer.exe" AND (COMMANDLINE notcontains "netlogon.bat,UsrLogon.cmd" AND COMMANDLINE != "PowerShell.exe" AND PROCESSNAME notendswith ":\Windows\System32\proquota.exe,:\Windows\SysWOW64\proquota.exe" AND PROCESSNAME notendswith ":\Program Files (x86)\Citrix\HDX\bin\cmstart.exe,:\Program Files (x86)\Citrix\HDX\bin\icast.exe,:\Program Files (x86)\Citrix\System32\icast.exe,:\Program Files\Citrix\HDX\bin\cmstart.exe,:\Program Files\Citrix\HDX\bin\icast.exe,:\Program Files\Citrix\System32\icast.exe" AND isExist(PROCESSNAME)) select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Tom Ueltschi (@c_APT_ure), Tim Shelton
