Suspicious Speech Runtime Binary Child Process

Hunt Hypothesis

Detects suspicious Speech Runtime Binary Execution by monitoring its child processes. Child processes spawned by SpeechRuntime.exe could indicate an attempt for lateral movement via COM & DCOM hijacki

Detection Rule

Sigma (Original)

title: Suspicious Speech Runtime Binary Child Process
id: 78f10490-f2f4-4d19-a75b-4e0683bf3b8d
status: experimental
description: |
    Detects suspicious Speech Runtime Binary Execution by monitoring its child processes.
    Child processes spawned by SpeechRuntime.exe could indicate an attempt for lateral movement via COM & DCOM hijacking.
references:
    - https://github.com/rtecCyberSec/SpeechRuntimeMove
author: andrewdanis
date: 2025-10-23
logsource:
    category: process_creation
    product: windows
tags:
    - attack.lateral-movement
    - attack.stealth
    - attack.t1021.003
    - attack.t1218
detection:
    selection:
        ParentImage|endswith: '\SpeechRuntime.exe'
    condition: selection
falsepositives:
    - Unlikely.
level: high

KQL (Azure Sentinel)

imProcessCreate
| where ParentProcessName endswith "\\SpeechRuntime.exe" or ActingProcessName endswith "\\SpeechRuntime.exe"

Required Data Sources

False Positive Guidance

• Unlikely.

MITRE ATT&CK Context

• Tactic: Lateral Movement
• Technique: T1021.003 — T1021.003
• Technique: T1218 — T1218

References

• https://github.com/rtecCyberSec/SpeechRuntimeMove
• SigmaHQ Rule