Suspicious Service Installed

Status: test
Severity: medium
Log source: category registry_set, product windows
Author: xknow (@xknow_infosec), xorxes (@xor_xes)
Source: github.com/SigmaHQ/sigma

Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders. Both services are used in the tool Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU (https://github.com/hfiref0x/KDU)

Known false positives

Other legimate tools using this service names and drivers. Note - clever attackers may easily bypass this detection by just renaming the services. Therefore just Medium-level and don't rely on it.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Suspicious Service Installed
id: f2485272-a156-4773-82d7-1d178bc4905b
status: test
description: |
  Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders.
  Both services are used in the tool Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU (https://github.com/hfiref0x/KDU)
references:
    - https://web.archive.org/web/20200419024230/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/
author: xknow (@xknow_infosec), xorxes (@xor_xes)
date: 2019-04-08
modified: 2026-06-29
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject:
            - 'HKLM\System\CurrentControlSet\Services\NalDrv\ImagePath'
            - 'HKLM\System\CurrentControlSet\Services\PROCEXP152\ImagePath'
    filter:
        Image|endswith:
            # Please add the full paths that you use in your environment to tighten the rule
            - '\procexp64.exe'
            - '\procexp64a.exe'
            - '\procexp.exe'
            - '\procmon64.exe'
            - '\procmon64a.exe'
            - '\procmon.exe'
            - '\handle.exe'
            - '\handle64.exe'
            - '\handle64a.exe'
        Details|contains: '\WINDOWS\system32\Drivers\PROCEXP152.SYS'
    condition: selection and not filter
falsepositives:
    - Other legimate tools using this service names and drivers. Note - clever attackers may easily bypass this detection by just renaming the services. Therefore just Medium-level and don't rely on it.
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    TargetObject:
        - 'HKLM\System\CurrentControlSet\Services\NalDrv\ImagePath'
        - 'HKLM\System\CurrentControlSet\Services\PROCEXP152\ImagePath'

Stage 2: `not filter`

filter:
    Image|endswith:
        - '\procexp64.exe'
        - '\procexp64a.exe'
        - '\procexp.exe'
        - '\procmon64.exe'
        - '\procmon64a.exe'
        - '\procmon.exe'
        - '\handle.exe'
        - '\handle64.exe'
        - '\handle64a.exe'
    Details|contains: '\WINDOWS\system32\Drivers\PROCEXP152.SYS'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	ends_with	`\handle.exe`	`excludes:Image` `field:"Image" value:"\handle.exe"`
`Image`	ends_with	`\handle64.exe`	`excludes:Image` `field:"Image" value:"\handle64.exe"`
`Image`	ends_with	`\handle64a.exe`	`excludes:Image` `field:"Image" value:"\handle64a.exe"`
`Image`	ends_with	`\procexp.exe`	`excludes:Image` `field:"Image" value:"\procexp.exe"`
`Image`	ends_with	`\procexp64.exe`	`excludes:Image` `field:"Image" value:"\procexp64.exe"`
`Image`	ends_with	`\procexp64a.exe`	`excludes:Image` `field:"Image" value:"\procexp64a.exe"`
`Image`	ends_with	`\procmon.exe`	`excludes:Image` `field:"Image" value:"\procmon.exe"`
`Image`	ends_with	`\procmon64.exe`	`excludes:Image` `field:"Image" value:"\procmon64.exe"`
`Image`	ends_with	`\procmon64a.exe`	`excludes:Image` `field:"Image" value:"\procmon64a.exe"`
`Details`	match	`\WINDOWS\system32\Drivers\PROCEXP152.SYS`	`excludes:Details` `field:"Details" value:"\WINDOWS\system32\Drivers\PROCEXP152.SYS"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	eq	`HKLM\System\CurrentControlSet\Services\NalDrv\ImagePath` `HKLM\System\CurrentControlSet\Services\PROCEXP152\ImagePath`	`field:"TargetObject" kind:eq`