Process Monitor Driver Creation By Non-Sysinternals Binary

Status: test
Severity: medium
Log source: category file_event, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.

Known false positives

Some false positives may occur with legitimate renamed process monitor binaries

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1068` Exploitation for Privilege Escalation

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: Process Monitor Driver Creation By Non-Sysinternals Binary
id: a05baa88-e922-4001-bc4d-8738135f27de
status: test
description: Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.
references:
    - Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-05
modified: 2026-06-29
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1068
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains: '\procmon'
        TargetFilename|endswith: '.sys'
    filter_main_process_explorer:
        Image|endswith:
            - '\procmon.exe'
            - '\procmon64.exe'
            - '\procmon64a.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Some false positives may occur with legitimate renamed process monitor binaries
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    TargetFilename|contains: '\procmon'
    TargetFilename|endswith: '.sys'

Stage 2: `not filter_main_process_explorer`

filter_main_process_explorer:
    Image|endswith:
        - '\procmon.exe'
        - '\procmon64.exe'
        - '\procmon64a.exe'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	ends_with	`\procmon.exe`	`excludes:Image` `field:"Image" value:"\procmon.exe"`
`Image`	ends_with	`\procmon64.exe`	`excludes:Image` `field:"Image" value:"\procmon64.exe"`
`Image`	ends_with	`\procmon64a.exe`	`excludes:Image` `field:"Image" value:"\procmon64a.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	ends_with	`.sys` corpus 6 (sigma 6)	`field:"TargetFilename" kind:ends_with value:".sys"`
`TargetFilename`	match	`\procmon`	`field:"TargetFilename" kind:match value:"\procmon"`