Unusual Child Process from System Virtual Process Indicates Process Injection

This detection identifies suspicious child processes spawned from the Windows System process (PID 4). The System process is a critical component responsible for managing system-level operations. Attackers may attempt to inject malicious code into the System process to evade detection and execute unauthorized actions. This detection focuses on identifying anomalous child processes originating from the System process, excluding known legitimate executables such as Registry, MemCompression, and smss.exe. The rule relies on process creation events and aims to detect process injection attempts, which are often used for defense evasion. This rule was created by Elastic and last updated on 2026/04/07.

Attack Chain

1. An attacker gains initial access to the system through various means, such as exploiting a vulnerability or using stolen credentials.
2. The attacker attempts to inject malicious code into a running process. In this case, the System process (PID 4) is targeted.
3. The attacker's code overwrites a portion of the System process's memory with malicious instructions.
4. The attacker triggers the execution of the injected code within the System process.
5. The injected code spawns a new child process from the System process. This child process is typically unexpected and malicious.
6. The malicious child process performs unauthorized actions, such as downloading malware, establishing command and control, or exfiltrating data.
7. The attacker leverages the elevated privileges of the System process to further compromise the system and evade detection.

Impact

Successful process injection into the System process can lead to complete system compromise. The attacker gains elevated privileges and can perform any action on the system, including installing malware, stealing sensitive data, and disrupting critical services. Due to the critical nature of the System process, a successful attack can have severe consequences for the availability, integrity, and confidentiality of the system and its data. The rule's high risk score of 73 reflects the potential impact of successful exploitation.

Recommendation

• Enable process creation logging (e.g., Sysmon Event ID 1) to capture child processes and their parent processes, which is required for the detections below.
• Deploy the Sigma rule Unusual Child Process from System Virtual Process to your SIEM and tune the exclusions for your specific environment.
• Investigate any alerts generated by this rule by examining the process details of the suspicious child process, the events leading up to the process creation, and any associated network activity.
• Review and update the exclusion list of legitimate processes to minimize false positives and ensure accurate detection.