Detection of Anomalous Cross-Architecture Process Execution

This threat brief focuses on an anomalous execution pattern where a 32-bit process residing in C:\Windows\SysWOW64\ initiates a 64-bit executable located in C:\Windows\System32. In standard Windows environments, 32-bit processes are expected to interact primarily with 32-bit binaries within their own directory structure.

Deviation from this norm, specifically the invocation of 64-bit System32 binaries by a SysWOW64 parent process, is a known technique utilized by threat actors for process injection, privilege escalation, evasion, and unauthorized execution hijacking. Security teams should monitor for this pattern, particularly when the spawning process is unsigned, unusual, or associated with known malicious activity, as seen in campaigns attributed to actors such as those behind DarkGate and Salt Typhoon. While software updaters and compatibility tools may trigger this, the anomaly is a high-fidelity signal for hunting potential post-exploitation movement.

Attack Chain

1. Attacker achieves initial execution of a 32-bit malicious binary dropped in C:\Windows\SysWOW64.
2. The malicious 32-bit process identifies a target 64-bit binary in C:\Windows\System32\ for hijacking or escalation.
3. The 32-bit process spawns the 64-bit binary, crossing the architecture boundary.
4. The 64-bit binary is either executed directly or manipulated via process injection (e.g., remote thread injection).
5. The attacker gains the capability to operate within the 64-bit address space of the target process.
6. Attacker leverages the higher-privilege or 64-bit context to perform further reconnaissance, credential dumping, or lateral movement.
7. Final objective is achieved, such as long-term persistence or exfiltration.

Impact

Success of this technique allows an attacker to bypass 32-bit environment restrictions, escalate privileges, and hide malicious activity within the context of legitimate Windows system processes. This can lead to full system compromise, exfiltration of sensitive organizational data, and long-term persistence within targeted enterprise endpoints.

Recommendation

1. Deploy the Sigma rule below to identify cross-architecture execution patterns in endpoint telemetry.
2. Filter out known benign software updaters and legitimate compatibility tools within your environment to reduce noise.
3. Enable Sysmon Event ID 1 (Process Creation) or Windows Event Log 4688 to capture the required command-line and path telemetry.
4. Investigate any instances where the parent process in SysWOW64 is unsigned or anomalous.