Detection rules › Splunk
Potential Sysinternals Tool Execution (Sysmon)
Sysinternals is a widely-used set of utilities for endpoint management, troubleshooting, and monitoring and is available for free from Microsoft. While not installed by default, it can be considered a LOLBAS due to its ubiquity in enterprise environments. Threat actors can abuse these utilities in a variety of ways including information gathering, remote command execution, memory dumping, and many more. This use case detects command line executions including the accepteula flag. The names of individual SysInternal tools have not been included to account for instances where the process has been renamed. Allowlisting by process path for known benign executables using -accepteula or /accepteula combined with usernames expected to use Sysinternals is recommended to reduce false positives
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1218 System Binary Proxy Execution |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '22594.40765'
title: Potential Sysinternals Tool Execution
description: 'Sysinternals is a widely-used set of utilities for endpoint management,
troubleshooting, and monitoring and is available for free from Microsoft. While
not installed by default, it can be considered a LOLBAS due to its ubiquity in enterprise
environments. Threat actors can abuse these utilities in a variety of ways including
information gathering, remote command execution, memory dumping, and many more.
This use case detects command line executions including the accepteula flag. The
names of individual SysInternal tools have not been included to account for instances
where the process has been renamed. Allowlisting by process path for known benign
executables using -accepteula or /accepteula combined with usernames expected to
use Sysinternals is recommended to reduce false positives. -- Threat Actor Association:
Cluster Alpha (STAC1248) - Software Association: Fog -- LOLBINS/LOLBAS'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
"-accepteula" OR "/accepteula" | regex process="(?i)\s(-|\/)accepteula" | table
_time, host, user host, process, parent_process_path | bin span=1s | stats values(*)
as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
technique_id:
- T1218
data_category:
- Windows Sysmon
references:
- https://learn.microsoft.com/en-us/sysinternals/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") "-accepteula" OR "/accepteula"
Stage 2: regex
| regex process="(?i)\s(-|\/)accepteula"
Stage 3: table
| table _time, host, user host, process, parent_process_path
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>1<" |
| 1 | "-accepteula" |
| 1 | "/accepteula" |