huntrule

System Informer Execution on Windows Process Creation

Alerts on Windows executions of SystemInformer.exe using matching filenames, metadata, and known hashes.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-05-08
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence → Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation events where the executable matches SystemInformer.exe based on image path, file metadata fields, and specific hash values. System Informer can be used to inspect and manipulate processes and low-level system behavior, making it attractive for stealthy discovery or privilege-related activities. The detection relies on Windows process creation telemetry that includes the process image name/path, embedded file properties, and executable hashes.

Reporting behind it

Related detections9 linkedT1543 — drag to rearrange
Windows Process Hacker Execution Identified by Image Metadata and Hashes
Suspicious GitHub Actions Runner In Hidden Directory via Shell (via process_creation)
Suspicious Self-Hosted GitHub Actions Runner Started As Root via Shell (via process_creation)
Suspicious GitHub Self-Hosted Runner Registration via Audit Log (via github)
Malicious Fire Ant Hypervisor Backdoor Artifacts on ESXi and vCenter (via file_event)
Malicious Turla Kopiluwak Reconnaissance Output to Windows Temp via process_creation
Suspicious Windows Defender Support Directory Enumeration via Process Creation
Suspicious System Reconnaissance via Windows Script Host
Suspicious Host Reconnaissance Command Chain via cmd
System Informer Execution on Windows Process Creation
Pivot detection · T1543 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.