PUA - Process Hacker Execution

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.

Known false positives

While sometimes 'Process Hacker is used by legitimate administrators, the execution of Process Hacker must be investigated and allowed on a case by case basis

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1543` Create or Modify System Process
Privilege Escalation	`T1543` Create or Modify System Process
Stealth	`T1564` Hide Artifacts `T1622` Debugger Evasion
Discovery	`T1622` Debugger Evasion

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: PUA - Process Hacker Execution
id: 811e0002-b13b-4a15-9d00-a613fce66e42
related:
    - id: 5722dff1-4bdd-4949-86ab-fbaf707e767a
      type: similar
status: test
description: |
    Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc).
    Process Hacker is a tool to view and manipulate processes, kernel options and other low level options.
    Threat actors abused older vulnerable versions to manipulate system processes.
references:
    - https://processhacker.sourceforge.io/
    - https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/
author: Florian Roth (Nextron Systems)
date: 2022-10-10
modified: 2024-11-23
tags:
    - attack.discovery
    - attack.persistence
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1622
    - attack.t1564
    - attack.t1543
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|contains: '\ProcessHacker_'
        - Image|endswith: '\ProcessHacker.exe'
        - OriginalFileName:
              - 'ProcessHacker.exe'
              - 'Process Hacker'
        - Description: 'Process Hacker'
        - Product: 'Process Hacker'
        - Hashes|contains:
              - 'MD5=68F9B52895F4D34E74112F3129B3B00D'
              - 'MD5=B365AF317AE730A67C936F21432B9C71'
              - 'SHA1=A0BDFAC3CE1880B32FF9B696458327CE352E3B1D'
              - 'SHA1=C5E2018BF7C0F314FED4FD7FE7E69FA2E648359E'
              - 'SHA256=D4A0FE56316A2C45B9BA9AC1005363309A3EDC7ACF9E4DF64D326A0FF273E80F'
              - 'SHA256=BD2C2CF0631D881ED382817AFCCE2B093F4E412FFB170A719E2762F250ABFEA4'
              - 'IMPHASH=3695333C60DEDECDCAFF1590409AA462'
              - 'IMPHASH=04DE0AD9C37EB7BD52043D2ECAC958DF'
    condition: selection
falsepositives:
    - While sometimes 'Process Hacker is used by legitimate administrators, the execution of Process Hacker must be investigated and allowed on a case by case basis
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    - Image|contains: '\ProcessHacker_'
    - Image|endswith: '\ProcessHacker.exe'
    - OriginalFileName:
          - 'ProcessHacker.exe'
          - 'Process Hacker'
    - Description: 'Process Hacker'
    - Product: 'Process Hacker'
    - Hashes|contains:
          - 'MD5=68F9B52895F4D34E74112F3129B3B00D'
          - 'MD5=B365AF317AE730A67C936F21432B9C71'
          - 'SHA1=A0BDFAC3CE1880B32FF9B696458327CE352E3B1D'
          - 'SHA1=C5E2018BF7C0F314FED4FD7FE7E69FA2E648359E'
          - 'SHA256=D4A0FE56316A2C45B9BA9AC1005363309A3EDC7ACF9E4DF64D326A0FF273E80F'
          - 'SHA256=BD2C2CF0631D881ED382817AFCCE2B093F4E412FFB170A719E2762F250ABFEA4'
          - 'IMPHASH=3695333C60DEDECDCAFF1590409AA462'
          - 'IMPHASH=04DE0AD9C37EB7BD52043D2ECAC958DF'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Description`	eq	`Process Hacker`	`field:"Description" kind:eq value:"Process Hacker"`
`Hashes`	match	`IMPHASH=04DE0AD9C37EB7BD52043D2ECAC958DF` `IMPHASH=3695333C60DEDECDCAFF1590409AA462` `MD5=68F9B52895F4D34E74112F3129B3B00D` `MD5=B365AF317AE730A67C936F21432B9C71` `SHA1=A0BDFAC3CE1880B32FF9B696458327CE352E3B1D` `SHA1=C5E2018BF7C0F314FED4FD7FE7E69FA2E648359E` `SHA256=BD2C2CF0631D881ED382817AFCCE2B093F4E412FFB170A719E2762F250ABFEA4` `SHA256=D4A0FE56316A2C45B9BA9AC1005363309A3EDC7ACF9E4DF64D326A0FF273E80F`	`field:"Hashes" kind:match`
`Image`	ends_with	`\ProcessHacker.exe`	`field:"Image" kind:ends_with value:"\ProcessHacker.exe"`
`Image`	match	`\ProcessHacker_`	`field:"Image" kind:match value:"\ProcessHacker_"`
`OriginalFileName`	eq	`Process Hacker` `ProcessHacker.exe`	`field:"OriginalFileName" kind:eq`
`Product`	eq	`Process Hacker`	`field:"Product" kind:eq value:"Process Hacker"`