Wrong Account

Normal and Suspicious

A clean machine sits beside a suspicious one, and the pointer marks where to look.

How to Confirm It

Work through these in order. Each step names the page that shows how.

1. Read the account from the process token, live with Get-Process and its user name option. In a memory image windows.getsids lists the token's SIDs, its integrity level among them.Token and Privileges
2. In event 4688 in the Security log, take the account from the Target Subject when it is filled, else from the Creator Subject. The Creator Subject alone gives services and elevated programs the wrong account.Process Trees and Call Chains
3. Check the session. The SessionId from windows.pslist comes from the kernel, while windows.sessions reads environment values the process itself can change.Process Listings and Scans
4. Find what gave it that identity, reading the parent chain, and for a new logon session the logon events on the machine.Process Trees and Call Chains

What Defenders See

Each record names its log and what must be switched on to get it.

False Positives

Per-user services run svchost.exe as the signed-in person under names such as CDPUserSvc_<LUID>, and Administrator protection runs elevated programs as a hidden, system-generated account.

Management agents, installers and scheduled tasks run shells as SYSTEM in session 0 every day, so judge them by their parent and their command.

Blind Spots

A thread can work under another account's token while its process keeps its own, and Velociraptor's Windows.Detection.Impersonation finds such threads.

Without administrator rights a live tool may not read a SYSTEM process's owner, so an empty account is not a finding. Run the check elevated.

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

// Core processes running under a person's account, and shells running as SYSTEM in session 0DeviceProcessEvents| where Timestamp > ago(30d)| extend Name = tolower(FileName)| where (Name in ("smss.exe", "csrss.exe", "wininit.exe", "winlogon.exe", "services.exe", "lsass.exe", "lsaiso.exe", "spoolsv.exe")        and AccountSid != "S-1-5-18")    or (Name in ("cmd.exe", "powershell.exe", "pwsh.exe") and AccountSid == "S-1-5-18" and CreatedProcessSessionId == 0)| project Timestamp, DeviceName, FileName, FolderPath, AccountName, AccountSid, ProcessIntegrityLevel, CreatedProcessSessionId, InitiatingProcessFileName, ProcessCommandLine| order by Timestamp desc

In a Memory Image

Volatility 3 reads a memory image, and each of its plugins below shows part of this sign.

• windows.getsids (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. getsids means get SIDs, the security IDs of accounts and groups. The SIDs in each token, S-1-5-18 for SYSTEM and a person's own SID for their programs, with the groups beside them.
• windows.privileges (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. Each token's privileges and whether they are enabled. Debug rights switched on in a person's program need a reason.
• windows.pslist (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. pslist means process list. The session each process runs in, read from the kernel.
• windows.sessions (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. Session details read from environment variables, which the process itself can change, so a lead, never proof.

How to Prevent It

Each control helps prevent it, and its line says what it does here.

• ASR: Block process creations originating from PSExec and WMI commands (opens in a new tab) Blocks the PsExec and WMI route to a SYSTEM shell like the one on ws-042.
• Administrator protection (opens in a new tab) Admins work without admin rights, and each approved elevation runs as a hidden account whose token ends with the process.
• Audit Process Creation (opens in a new tab) Writes event 4688 in the Security log with the creator, the target account and the integrity level of every new process. Check it in the Registry: Advanced Audit Policy

Related

Where It Matters Most

• svchost.exe A person's account on a copy that hosts no per-user service.
• userinit.exe Running as SYSTEM, or as any account other than the person signing in.
• explorer.exe Running as SYSTEM, or as an account that has not signed in here.

On ws-042, 12 Oct 2026

Open it in the tree: cmd.exeSuspicious

Travels with

• Wrong Parent A process under an account it never uses may also have a parent that never starts it, as the SYSTEM shell under PSEXESVC.exe does.

Check It in the Registry

User Account Control Settings

Read with Active Directory

• Reading Logon Events Which logon a process's session came from, and how to read the logon type and token in event 4624 in the Security log.
• Explicit Credentials on the Source Machine A program started with another account's credentials, which event 4648 in the Security log records on the source machine.

Sources

• Microsoft Learn: 4688(S) A new process has been created (opens in a new tab)
• Microsoft Learn: LocalSystem account (opens in a new tab)
• Microsoft Learn: Per-user services in Windows (opens in a new tab)
• Microsoft Learn: Mandatory Integrity Control (standard users at medium, elevated users at high, services at system) (opens in a new tab)
• Microsoft Learn: Get-Process, Windows PowerShell 5.1 (the user name option needs an elevated session) (opens in a new tab)
• Microsoft Learn: Administrator protection (opens in a new tab)
• Velociraptor: Windows.Detection.Impersonation (opens in a new tab)
• Volatility 3: windows.getsids (opens in a new tab)