Processes running with SYSTEM integrity normally originate from trusted Windows or application locations. When a SYSTEM-level process executes from a user-writable directory, the combination can provide a useful privilege-escalation signal.
The source defines a behavioral hunt for exactly this condition.
Detection Logic
The query requires:
Sysmon Process Creation, Event ID 1;
integrity level set to
System;either the process image or parent image located under
Users,ProgramData, orTemp.
data.win.system.eventID:1 and data.win.eventdata.integrityLevel:System and (data.win.eventdata.image:(*\Users\* or *\ProgramData\* or *\Temp\*) or data.win.eventdata.parentImage:(*\Users\* or *\ProgramData\* or *\Temp\*))
The source associates the hunt with Windows kernel, CLFS, AFD, Win32k, DWM, Defender, and other local elevation-of-privilege zero-days from 2025 and 2026.
It recorded 1,638 matches during the previous 30 days.
Why User-Writable Locations Matter
Directories such as temporary folders and parts of user profiles are commonly writable by standard users or applications. SYSTEM-level execution from these locations is therefore more interesting than execution from trusted Windows directories.
The behavior is not automatically malicious. Installers, update mechanisms, or enterprise management agents can legitimately stage files under temporary or shared locations.
The value comes from identifying SYSTEM execution where the path, parent process, or file is not part of the approved baseline.
Investigation Priorities
For each event, review:
full executable path;
parent process;
file creation time;
digital signature;
hash;
user associated with the original activity;
command line;
preceding process chain;
additional SYSTEM-level child processes.
If the executable appeared shortly before execution, identify which process created it.
Baseline and Tuning
Because the source returned more than a thousand events, environment-specific tuning is necessary.
Start by grouping results by:
executable path;
parent process;
hostname;
signer;
hash.
Repeated execution of a known signed updater can be documented. Rare unsigned binaries under Temp or a user directory deserve more attention.
Correlation Opportunities
This hunt becomes stronger when combined with:
exploit-related crashes;
suspicious browser or Office activity;
security-control modification;
credential dumping;
persistence;
ransomware staging.
A chain from user-level execution to SYSTEM-level process creation, followed by credential access or persistence, is particularly important.
Operational Value
The rule provides a generic way to hunt privilege escalation without requiring a signature for a specific kernel exploit.
By focusing on SYSTEM integrity plus unusual execution paths, defenders can identify behavior that may appear across multiple local elevation-of-privilege vulnerabilities.
