huntrule

System Informer Execution on Windows Process Creation

Alerts on Windows executions of SystemInformer.exe using matching filenames, metadata, and known hashes.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-05-08
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence → Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation events where the executable matches SystemInformer.exe based on image path, file metadata fields, and specific hash values. System Informer can be used to inspect and manipulate processes and low-level system behavior, making it attractive for stealthy discovery or privilege-related activities. The detection relies on Windows process creation telemetry that includes the process image name/path, embedded file properties, and executable hashes.

Reporting behind it

Related detections9 linkedT1082 — drag to rearrange
Windows Process Hacker Execution Identified by Image Metadata and Hashes
Suspicious System Profiler Hardware Enumeration (via process_creation)
Suspicious Hardware Inventory Discovery via WMIC Device Class Queries (via process_creation)
Suspicious macOS Hardware Identifier Reconnaissance via ioreg (via process_creation)
Malicious BRICKSTORM Backdoor Execution via Masqueraded Binary Path
Suspicious Encoded PowerShell Host Reconnaissance via Get-ComputerInfo via ps_script
Suspicious Host Recon via ConvertFrom-Csv and ConvertTo-Json
Suspicious Windows Security Spoofing via pin Executable Writing output.txt via process_creation
Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)
System Informer Execution on Windows Process Creation
Pivot detection · T1082 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.