Possible Execution of Sysinternals Utilities AppX Versions (via appmodel-runtime)

title: Possible Execution of Sysinternals Utilities AppX Versions (via appmodel-runtime)
id: 9015cccd-4452-5f30-a704-6fa281b4dd5a
status: stable
description: This rule detects execution of Sysinternals tools via an AppX package. Attackers could install the Sysinternals Suite to get access to tools such as psexec and procdump to avoid detection based on System paths.
references:
    - https://learn.microsoft.com/en-us/sysinternals/downloads/microsoft-store
author: Huntrule Team
date: 2026-07-01
tags:
    - attack.execution
    - attack.stealth
    - attack.defense-evasion
    - attack.t1036
logsource:
    product: windows
    service: appmodel-runtime
detection:
    selection:
        EventID: 201
        ImageName:
            - 'procdump.exe'
            - 'psloglist.exe'
            - 'psexec.exe'
            - 'livekd.exe'
            - 'ADExplorer.exe'
    condition: selection
falsepositives:
    - Unknown
level: low