detection.wiki

Detection rules › Sigma

Process Explorer Driver Creation By Non-Sysinternals Binary

Status
test
Severity
high
Log source
product windows, category file_event
Author
Florian Roth (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself. Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1068 Exploitation for Privilege Escalation

Event coverage

ProviderEventTitle
SysmonEvent ID 11FileCreate

Rule body yaml

title: Process Explorer Driver Creation By Non-Sysinternals Binary
id: de46c52b-0bf8-4936-a327-aace94f94ac6
status: test
description: |
    Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself.
    Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.
references:
    - https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer
    - https://github.com/Yaxser/Backstab
    - https://www.elastic.co/security-labs/stopping-vulnerable-driver-attacks
    - https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/
author: Florian Roth (Nextron Systems)
date: 2023-05-05
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1068
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains: '\PROCEXP'
        TargetFilename|endswith: '.sys'
    filter_main_process_explorer:
        Image|endswith:
            - '\procexp.exe'
            - '\procexp64.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Some false positives may occur with legitimate renamed process explorer binaries
level: high

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_*

Stage 1: selection

selection:
    TargetFilename|contains: '\PROCEXP'
    TargetFilename|endswith: '.sys'

Stage 2: not filter_main_process_explorer

filter_main_process_explorer:
    Image|endswith:
        - '\procexp.exe'
        - '\procexp64.exe'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
Imageends_with\procexp.exe
Imageends_with\procexp64.exe

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetFilenameends_with
  • .sys corpus 6 (sigma 6)
TargetFilenamematch
  • \PROCEXP