SYSTEM Process Spawned by Non-Privileged Parent - Potential LPE (T1068)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•9

Detects a process running as NT AUTHORITY\SYSTEM that was spawned by a parent process not belonging to known legitimate SYSTEM-spawning Windows components. This behavioral pattern is a strong indicator of local privilege escalation (LPE), consistent with techniques such as CVE-2026-41091 (RedSun) and similar LPE exploits.