Suspicious Process Execution with SYSTEM in Command Line

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•1

Detects suspicious process executions where 'ctfmon.exe' or 'cloudfiles.exe' are initiated by a non-SYSTEM user but contain 'SYSTEM' in their command line. This could indicate an attempt to impersonate or escalate privileges, especially when combined with a successful logon event for the same user.