Potential Meterpreter/CobaltStrike Getsystem Activity

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•24

Detects the use of Meterpreter's or Cobalt Strike's 'getsystem' command by identifying specific command-line patterns associated with privilege escalation techniques. The rule looks for processes spawned by 'services.exe' that contain '/c', 'echo', and '\pipe\' (technique 1) or 'rundll32', '.dll,a', and '/p:' (technique 2), which are indicative of these tools attempting to elevate privileges.