Suspicious child process integrity level

Identifies the execution of the parent process running with low/medium integrity level that spawns a child process with the system integrity level. Because normal user-mode applications at lower integrity levels rarely legitimately create new processes running with SYSTEM privileges, this pattern is a strong indicator of privilege escalation or token manipulation where an attacker abuses a privileged token to execute code.

• Platform: Windows
• Severity: Critical
• MITRE Tactic: Privilege Escalation
• MITRE Techniques: T1134, T1134.002

Back to all rules