Sysinternals PsSuspend Execution

Title: Sysinternals PsSuspend Execution
Status: test
Description:Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes
References:
  -https://learn.microsoft.com/en-us/sysinternals/downloads/pssuspend
  -https://twitter.com/0gtweet/status/1638069413717975046
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-23
modified:2026-06-29
Tags:

• -'attack.privilege-escalation'
• -'attack.discovery'
• -'attack.persistence'
• -'attack.t1543.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
OriginalFileName:'pssuspend.exe'     - Image|endswith:
      - '\pssuspend.exe'
      - '\pssuspend64.exe'
      - '\pssuspend64a.exe'
  condition:selection
Falsepositives:
  -Unknown
Level: medium