Memory-write handle opened to a GUI process by another process

Siemphony@siemphonylowT1574.013unverified

AN1593's chain — locate the PEB via `NtQueryInformationProcess`, then `WriteProcessMemory` the `KernelCallbackTable`, then trigger a hijacked callback through a Windows message — has no step that Sysmon EventID 10 records directly: `WriteProcessMemory` is not a Sysmon event, and the PEB offset written is invisible to any log source in this brief. What EventID 10 does record is the `OpenProcess` call that has to precede the write, so this rule matches that handle acquisition and narrows it two ways: a `GrantedAccess` mask that includes memory-write, memory-operation and query-information rights (the minimum a `WriteProcessMemory` into another process's PEB needs, plus the broader full-access variants), and a `TargetImage` restricted to MITRE's `MonitoredProcesses` examples (`explorer.exe`, `notepad.exe`) plus other classic GUI-shell processes assembled here on the same logic — they load `user32.dll` and therefore have a `KernelCallbackTable` too (`mspaint.exe`, `wordpad.exe`, `calc.exe`). That combination is honestly a generic "something opened a writable handle to a GUI process" proxy, not a KernelCallbackTable-specific detector — any other injection technique targeting the same processes (classic DLL injection, hollowing) produces the same event, and legitimate UI-automation and accessibility tooling requests the same rights routinely, which the false positives below name. AN1593's `CallbackFunctions` and `AccessMaskThresholds` knobs describe a finer-grained signal — which callback slot was patched, and how the access mask compares to a per-process baseline — that this single event cannot carry; `TimeWindow`, correlating the open with a later suspicious message dispatch, needs a cross-event join lib/sigma does not model. Sysmon emits EventID 10 only where the configuration carries a `ProcessAccess` rule, and widely used baseline configurations scope that rule to `lsass.exe` alone — on such a host this rule returns zero rows regardless of what ran. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0577, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* ((GrantedAccess="0x1F0FFF" OR GrantedAccess="0x1F1FFF" OR GrantedAccess="0x1F2FFF" OR GrantedAccess="0x1F3FFF" OR GrantedAccess="0x1FFFFF" OR GrantedAccess="0x1438" OR GrantedAccess="0x438" OR GrantedAccess="0x1428" OR GrantedAccess="0x428") AND (TargetImage="*\\explorer.exe" OR TargetImage="*\\notepad.exe" OR TargetImage="*\\mspaint.exe" OR TargetImage="*\\wordpad.exe" OR TargetImage="*\\calc.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(GrantedAccess) == "0x1f0fff" OR TO_LOWER(GrantedAccess) == "0x1f1fff" OR TO_LOWER(GrantedAccess) == "0x1f2fff" OR TO_LOWER(GrantedAccess) == "0x1f3fff" OR TO_LOWER(GrantedAccess) == "0x1fffff" OR TO_LOWER(GrantedAccess) == "0x1438" OR TO_LOWER(GrantedAccess) == "0x438" OR TO_LOWER(GrantedAccess) == "0x1428" OR TO_LOWER(GrantedAccess) == "0x428") AND (TO_LOWER(TargetImage) LIKE "*\\\\explorer.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\notepad.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\mspaint.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\wordpad.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\calc.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_access,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="GrantedAccess" type="pcre2">(?i)(^0x1F0FFF$|^0x1F1FFF$|^0x1F2FFF$|^0x1F3FFF$|^0x1FFFFF$|^0x1438$|^0x438$|^0x1428$|^0x428$)</field>    <field name="TargetImage" type="pcre2">(?i)(\\explorer\.exe$|\\notepad\.exe$|\\mspaint\.exe$|\\wordpad\.exe$|\\calc\.exe$)</field>    <description>Memory-write handle opened to a GUI process by another process</description>    <mitre>      <id>T1574.013</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"process_access","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: process_access / windows
Level: low
Category: registry_persistence
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 1ea1cc09-1c4e-4708-b246-db506a8db0a6

ATT&CKT1574.013

T1574.013KernelCallbackTable

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

A process opening a handle to a GUI process with rights broad enough to write into its memory. AN1593 describes hijacking a process by locating its PEB via NtQueryInformationProcess, overwriting the KernelCallbackTable with WriteProcessMemory, then triggering the hijacked callback through a Windows message. None of those three steps is a Sysmon event in its own right — WriteProcessMemory isn't logged at all, and the PEB offset written is invisible to any log source this brief names. What Sysmon EventID 10 does capture is the OpenProcess call that necessarily precedes the write, so this rule matches that instead and is honest that it is a proxy for the technique, not a detector of the technique's actual mechanism.

02 · Telemetry you need

category: process_access, product: windows — Sysmon EventID 10. Sysmon only emits it where the config carries a ProcessAccess rule, and widely used baseline configurations scope that rule to lsass.exe alone — on such a host this rule returns zero rows regardless of what ran, because the telemetry for any other target was never generated.

03 · How the logic works

Two selections, ANDed:

selection_rights lists full-access masks alongside narrower combinations covering PROCESS_VM_WRITE, PROCESS_VM_OPERATION and PROCESS_QUERY_INFORMATION — the minimum a WriteProcessMemory into another process's PEB needs. selection_target restricts to GUI-shell processes that load user32.dll and therefore have a KernelCallbackTable to hijack in the first place. Only two of the five, explorer.exe and notepad.exe, are MITRE's own MonitoredProcesses examples from the brief; mspaint.exe, wordpad.exe and calc.exe are the pipeline's own extension of the same user32.dll logic, not additional MITRE-supplied values — an earlier draft blurred that distinction and it has been corrected. The rule cannot express AN1593's finer knobs: CallbackFunctions (which specific callback slot was patched) and AccessMaskThresholds (comparing the mask against a per-process baseline) both need visibility this event doesn't carry, and TimeWindow — correlating the open with a later suspicious message dispatch — needs a cross-event join lib/sigma doesn't model. The honest description of what remains: this is a generic "something opened a writable handle to a GUI process" proxy. Classic DLL injection and process hollowing targeting the same processes produce an identical event, so a hit is evidence of injection-capable access in general, not proof of this specific technique.

04 · Common false positives

Endpoint protection, DLP and accessibility tooling (screen readers, UI-automation frameworks, keystroke/clipboard monitors) routinely open memory-write handles to explorer.exe or notepad.exe to hook input or inject a monitoring stub — this is the dominant source of matches on any managed estate and is the reason level isn't higher. Remote-support and remote-desktop tools hook explorer.exe to render overlays or capture the desktop. Debuggers and crash handlers — WerFault.exe dumping a crashed notepad.exe, or an interactive WinDbg/Visual Studio attach — request full access as a matter of course. Anti-cheat engines, DRM wrappers and app-compat shims inject into common shell processes by design.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0577 and never run against a log line. The access-mask list and three of five target processes are the pipeline's own additions layered on MITRE's two examples, and the whole approach is a structural proxy rather than a direct observation of the technique.
tier_2: needs real EID10 volume against these five processes to see whether the access-mask narrowing actually separates injection from the named benign tools before this is trustworthy at any tier above scaffold.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude known-signed vendor binaries for the security/accessibility/remote- support tools once identified in your estate — this is where most of the volume lives. Narrow GrantedAccess to the tightest mask set that still covers the technique if full-access opens dominate your false-positive volume disproportionately. Consider retitling or annotating the rule to foreground the genericity ("GUI process opened with injection-capable access") so anyone triaging a hit doesn't over-attribute it to this specific technique over neighboring injection techniques. Widen Sysmon's ProcessAccess scope beyond lsass.exe deliberately, and expect volume to rise sharply when you do.

Declared by the author

Endpoint protection, DLP and accessibility software (screen readers, UI-automation frameworks, keystroke/clipboard monitoring agents) that routinely opens a memory-write handle to explorer.exe or notepad.exe to hook input or inject a monitoring stub, and is the dominant source of matches on any managed estate — the reason this rule is not rated higher.
Remote-support and remote-desktop tools (TeamViewer, VNC helpers, and similar) that hook explorer.exe to render overlays or capture the desktop for a remote viewer.
Debuggers and crash handlers: WerFault.exe collecting a dump of a crashed notepad.exe or mspaint.exe, or an interactive attach from WinDbg or Visual Studio, both request full access.
Anti-cheat engines, DRM wrappers and application-compatibility shims that inject into common shell and utility processes by design and present the same access masks.

Noise check0 of 1 fired

The baseline holds exactly one ordinary behaviour for this log type, and the rule does not fire on it. One event is close to no evidence: this says the rule is not caught by that one behaviour, and nothing more.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1574.013, evaluated against their process_access events.

Share this rule

/u/siemphony/1ea1cc09-1c4e-4708-b246-db506a8db0a6

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Memory-write handle opened to a GUI process by another process

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it