PUA - System Informer Execution

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Known false positives

System Informer is regularly used legitimately by system administrators or developers. Apply additional filters accordingly

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1543` Create or Modify System Process
Privilege Escalation	`T1543` Create or Modify System Process
Stealth	`T1564` Hide Artifacts
Discovery	`T1082` System Information Discovery

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: PUA - System Informer Execution
id: 5722dff1-4bdd-4949-86ab-fbaf707e767a
related:
    - id: 811e0002-b13b-4a15-9d00-a613fce66e42
      type: similar
status: test
description: Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations
references:
    - https://github.com/winsiderss/systeminformer
author: Florian Roth (Nextron Systems)
date: 2023-05-08
modified: 2024-11-23
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.discovery
    - attack.stealth
    - attack.t1082
    - attack.t1564
    - attack.t1543
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\SystemInformer.exe'
        - OriginalFileName: 'SystemInformer.exe'
        - Description: 'System Informer'
        - Product: 'System Informer'
        - Hashes|contains:
              # Note: add other hashes as needed
              # 3.0.11077.6550
              - 'MD5=19426363A37C03C3ED6FEDF57B6696EC'
              - 'SHA1=8B12C6DA8FAC0D5E8AB999C31E5EA04AF32D53DC'
              - 'SHA256=8EE9D84DE50803545937A63C686822388A3338497CDDB660D5D69CF68B68F287'
              - 'IMPHASH=B68908ADAEB5D662F87F2528AF318F12'
    condition: selection
falsepositives:
    - System Informer is regularly used legitimately by system administrators or developers. Apply additional filters accordingly
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    - Image|endswith: '\SystemInformer.exe'
    - OriginalFileName: 'SystemInformer.exe'
    - Description: 'System Informer'
    - Product: 'System Informer'
    - Hashes|contains:
          - 'MD5=19426363A37C03C3ED6FEDF57B6696EC'
          - 'SHA1=8B12C6DA8FAC0D5E8AB999C31E5EA04AF32D53DC'
          - 'SHA256=8EE9D84DE50803545937A63C686822388A3338497CDDB660D5D69CF68B68F287'
          - 'IMPHASH=B68908ADAEB5D662F87F2528AF318F12'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Description`	eq	`System Informer`	`field:"Description" kind:eq value:"System Informer"`
`Hashes`	match	`IMPHASH=B68908ADAEB5D662F87F2528AF318F12` `MD5=19426363A37C03C3ED6FEDF57B6696EC` `SHA1=8B12C6DA8FAC0D5E8AB999C31E5EA04AF32D53DC` `SHA256=8EE9D84DE50803545937A63C686822388A3338497CDDB660D5D69CF68B68F287`	`field:"Hashes" kind:match`
`Image`	ends_with	`\SystemInformer.exe`	`field:"Image" kind:ends_with value:"\SystemInformer.exe"`
`OriginalFileName`	eq	`SystemInformer.exe`	`field:"OriginalFileName" kind:eq value:"SystemInformer.exe"`
`Product`	eq	`System Informer`	`field:"Product" kind:eq value:"System Informer"`

PUA - System Informer Execution

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`