Process Explorer Driver Creation By Non-Sysinternals Binary

Status: test
Severity: high
Log source: category file_event, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself. Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.

Known false positives

Some false positives may occur with legitimate renamed process explorer binaries

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1068` Exploitation for Privilege Escalation

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: Process Explorer Driver Creation By Non-Sysinternals Binary
id: de46c52b-0bf8-4936-a327-aace94f94ac6
status: test
description: |
    Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself.
    Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.
references:
    - https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer
    - https://github.com/Yaxser/Backstab
    - https://www.elastic.co/security-labs/stopping-vulnerable-driver-attacks
    - https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/
author: Florian Roth (Nextron Systems)
date: 2023-05-05
modified: 2026-06-29
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1068
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains: '\PROCEXP'
        TargetFilename|endswith: '.sys'
    filter_main_process_explorer:
        Image|endswith:
            - '\procexp.exe'
            - '\procexp64.exe'
            - '\procexp64a.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Some false positives may occur with legitimate renamed process explorer binaries
level: high

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    TargetFilename|contains: '\PROCEXP'
    TargetFilename|endswith: '.sys'

Stage 2: `not filter_main_process_explorer`

filter_main_process_explorer:
    Image|endswith:
        - '\procexp.exe'
        - '\procexp64.exe'
        - '\procexp64a.exe'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	ends_with	`\procexp.exe`	`excludes:Image` `field:"Image" value:"\procexp.exe"`
`Image`	ends_with	`\procexp64.exe`	`excludes:Image` `field:"Image" value:"\procexp64.exe"`
`Image`	ends_with	`\procexp64a.exe`	`excludes:Image` `field:"Image" value:"\procexp64a.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	ends_with	`.sys` corpus 6 (sigma 6)	`field:"TargetFilename" kind:ends_with value:".sys"`
`TargetFilename`	match	`\PROCEXP`	`field:"TargetFilename" kind:match value:"\PROCEXP"`