Interactive Shell Spawned Under a Service Account

Detects process creation (EventID 4688) where a command interpreter runs under an account whose name marks it as a service account. Service accounts run services; they do not open shells. A cmd.exe or powershell.exe parented under one is a strong indicator that harvested service-account credentials are being used for hands-on-keyboard activity.

T1059.003 T1078.003

Test this rule in the simulator

Detection logic

Fires as soon as one event matches: `EventID` is 4688 AND `NewProcessName` ends with "cmd.exe" or "powershell.exe" or "pwsh.exe" AND `SubjectUserName` starts with "svc" or "sql" or "backup".

{
  "detection_type": "selection",
  "selection": {
    "EventID": 4688,
    "NewProcessName|endswith": [
      "cmd.exe",
      "powershell.exe",
      "pwsh.exe"
    ],
    "SubjectUserName|startswith": [
      "svc",
      "sql",
      "backup"
    ]
  }
}

Log source: product=windows, service=security · Event ID(s): 4688

Required log fields

NewProcessName
ParentProcessName
SubjectUserName
CommandLine

Enabling this in your environment

Where: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Detailed Tracking > Audit Process Creation

auditpol /set /subcategory:"Process Creation" /success:enable

CommandLine is NOT populated in 4688 by default - without the separate "Include command line in process creation events" policy this rule can still fire but the investigation has nothing to work with. Enable both, or prefer Sysmon Event ID 1, which carries the command line natively.

Interactive Shell Spawned Under a Service Account

Detection logic

Required log fields

Enabling this in your environment

Seen in incidents

False positives

References