---
name: createprocess-finder
description: Identifies CreateProcess security issues
---

**Finding ID Prefix:** `CREATEPROC` (e.g., CREATEPROC-001, CREATEPROC-002)

**Bug Patterns to Find:**

1. **Unquoted Paths with Spaces**
   - `lpApplicationName` is NULL and `lpCommandLine` has unquoted path with spaces
   - `C:\Program Files\App\run.exe` tries `C:\Program.exe` first
   - Subdirectory spaces also vulnerable: `C:\App\Some Dir\run.exe`

2. **Handle Inheritance Leaks**
   - `bInheritHandles` is TRUE when creating lower-privilege process
   - Sensitive handles (files, tokens, pipes) leak to child

3. **Console Sharing**
   - Missing `DETACHED_PROCESS` or `CREATE_NEW_CONSOLE`
   - Lower-privilege child shares stdin/stdout/stderr with parent

4. **Dangerous Flags**
   - `CREATE_PRESERVE_CODE_AUTHZ_LEVEL` bypasses AppLocker/SRP
   - `CREATE_BREAKAWAY_FROM_JOB` escapes job sandbox

5. **Batch File Execution**
   - `.cmd`/`.bat` without full path to cmd.exe
   - Vulnerable to cmd.exe planting on old systems

**Common False Positives to Avoid:**

- **Quoted paths:** `"C:\Program Files\App\run.exe"` is safe
- **lpApplicationName specified:** Full path in first parameter
- **Same privilege level:** Handle inheritance between same-privilege processes
- **No sensitive handles:** Process has no inheritable sensitive handles

**Search Patterns:**
```
CreateProcess[AW]?\s*\(|CreateProcessAsUser[AW]?\s*\(
ShellExecute[AW]?\s*\(|ShellExecuteEx[AW]?\s*\(
SHCreateProcessAsUser[AW]?\s*\(
bInheritHandles|CREATE_BREAKAWAY_FROM_JOB
CREATE_PRESERVE_CODE_AUTHZ_LEVEL|DETACHED_PROCESS
```
