Potential Fake Instance Of Hxtsr.EXE Executed

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Sreeman
Source: github.com/SigmaHQ/sigma

HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications. HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files". Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1036` Masquerading

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Potential Fake Instance Of Hxtsr.EXE Executed
id: 4e762605-34a8-406d-b72e-c1a089313320
status: test
description: |
    HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications.
    HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files".
    Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe
references:
    - Internal Research
author: Sreeman
date: 2020-04-17
modified: 2024-02-08
tags:
    - attack.stealth
    - attack.t1036
logsource:
    product: windows
    category: process_creation
detection:
    # TODO: Link this to the more generic system process rule
    selection:
        Image|endswith: '\hxtsr.exe'
    filter_main_hxtsr:
        Image|contains: ':\program files\windowsapps\microsoft.windowscommunicationsapps_'
        Image|endswith: '\hxtsr.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    Image|endswith: '\hxtsr.exe'

Stage 2: `not filter_main_hxtsr`

filter_main_hxtsr:
    Image|contains: ':\program files\windowsapps\microsoft.windowscommunicationsapps_'
    Image|endswith: '\hxtsr.exe'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	ends_with	`\hxtsr.exe`	`excludes:Image` `field:"Image" value:"\hxtsr.exe"`
`Image`	match	`:\program files\windowsapps\microsoft.windowscommunicationsapps_`	`excludes:Image` `field:"Image" value:":\program files\windowsapps\microsoft.windowscommunicationsapps_"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\hxtsr.exe`	`field:"Image" kind:ends_with value:"\hxtsr.exe"`