Adversary use of sacrificial processes with improper arguments
Attackers utilize common Windows binaries as sacrificial processes for capability injection while failing to provide necessary command-line arguments, leaving them detectable by their default-invocation signatures.
Triage facts
Revision 1- Applicability
- Windows
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 10, 03:04 UTC
- Detection
- 1 rule
- Source quality
- A1Likely
Attackers often spawn legitimate Windows binaries (such as rundll32.exe, WerFault.exe, or regsvr32.exe) as sacrificial processes to host injected malicious code. A failure in operational security (opsec) defaults results in these processes being launched without the required arguments or functional context, deviating from their standard system behavior and creating a signature of the process launching itself without additional parameters.
Impact
Successful exploitation allows for the execution of arbitrary code within the context of a legitimate system process. This technique is frequently observed in C2 frameworks (e.g., Cobalt Strike) where improper configuration of sacrificial processes allows for process-hollowing or injection detection.
Recommendation
Deploy the provided Sigma rules to detect unauthorized or improperly invoked system binaries. Monitor environment-specific installers and update processes, as these commonly trigger similar behavior and may require rule tuning to prevent false positives.
Immediate actions
Deploy Sigma rule for detection of processes spawned without arguments
Mitigations
Baseline standard process invocation patterns in the environment to tune out false positives
T1218.011
Detection coverage 1
Detect Suspicious Sacrificial Process Invocation
highDetects common Windows binaries spawned as sacrificial processes without arguments, indicated by the process image appearing as the command line.
Detection queries are available on the platform. Get full rules →