System Informer Execution on Windows Process Creation

Alerts on Windows executions of SystemInformer.exe using matching filenames, metadata, and known hashes.

FreeUnreviewedSigmamediumv1

system-informer-execution-on-windows-process-creation-5722dff1

title: System Informer Execution on Windows Process Creation
id: 6d52ab06-c18d-4f64-a1f3-b2ecd9acbb1e
related:
  - id: 811e0002-b13b-4a15-9d00-a613fce66e42
    type: similar
  - id: 5722dff1-4bdd-4949-86ab-fbaf707e767a
    type: derived
status: test
description: This rule flags process creation events where the executable matches SystemInformer.exe based on image path, file metadata fields, and specific hash values. System Informer can be used to inspect and manipulate processes and low-level system behavior, making it attractive for stealthy discovery or privilege-related activities. The detection relies on Windows process creation telemetry that includes the process image name/path, embedded file properties, and executable hashes.
references:
  - https://github.com/winsiderss/systeminformer
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_system_informer.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2023-05-08
modified: 2024-11-23
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.discovery
  - attack.stealth
  - attack.t1082
  - attack.t1564
  - attack.t1543
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \SystemInformer.exe
    - OriginalFileName: SystemInformer.exe
    - Description: System Informer
    - Product: System Informer
    - Hashes|contains:
        - MD5=19426363A37C03C3ED6FEDF57B6696EC
        - SHA1=8B12C6DA8FAC0D5E8AB999C31E5EA04AF32D53DC
        - SHA256=8EE9D84DE50803545937A63C686822388A3338497CDDB660D5D69CF68B68F287
        - IMPHASH=B68908ADAEB5D662F87F2528AF318F12
  condition: selection
falsepositives:
  - System Informer is regularly used legitimately by system administrators or developers. Apply additional filters accordingly
level: medium
license: DRL-1.1

What it detects

This rule flags process creation events where the executable matches SystemInformer.exe based on image path, file metadata fields, and specific hash values. System Informer can be used to inspect and manipulate processes and low-level system behavior, making it attractive for stealthy discovery or privilege-related activities. The detection relies on Windows process creation telemetry that includes the process image name/path, embedded file properties, and executable hashes.

Known false positives

System Informer is regularly used legitimately by system administrators or developers. Apply additional filters accordingly

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.