System Informer Execution on Windows Process Creation

Alerts on Windows executions of SystemInformer.exe using matching filenames, metadata, and known hashes.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-05-08
Updated: 2026-07-30

ATT&CK techniques

Persistence → Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1543Create or Modify System Process
Priv Esc
- T1543Create or Modify System Process
Defense Evasion
- T1564Hide Artifacts
Cred Access
Discovery
- T1082System Information Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where the executable matches SystemInformer.exe based on image path, file metadata fields, and specific hash values. System Informer can be used to inspect and manipulate processes and low-level system behavior, making it attractive for stealthy discovery or privilege-related activities. The detection relies on Windows process creation telemetry that includes the process image name/path, embedded file properties, and executable hashes.

Reporting behind it

Related detections9 linkedT1082 — drag to rearrange

Windows Process Hacker Execution Identified by Image Metadata and Hashes

Suspicious System Profiler Hardware Enumeration (via process_creation)

Suspicious Hardware Inventory Discovery via WMIC Device Class Queries (via process_creation)

Suspicious macOS Hardware Identifier Reconnaissance via ioreg (via process_creation)

Malicious BRICKSTORM Backdoor Execution via Masqueraded Binary Path

Suspicious Encoded PowerShell Host Reconnaissance via Get-ComputerInfo via ps_script

Suspicious Host Recon via ConvertFrom-Csv and ConvertTo-Json

Suspicious Windows Security Spoofing via pin Executable Writing output.txt via process_creation

Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)

System Informer Execution on Windows Process Creation

Pivot detection · T1082 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

system-informer-execution-on-windows-process-creation-5722dff1

title: System Informer Execution on Windows Process Creation
id: 6d52ab06-c18d-4f64-a1f3-b2ecd9acbb1e
related:
  - id: 811e0002-b13b-4a15-9d00-a613fce66e42
    type: similar
  - id: 5722dff1-4bdd-4949-86ab-fbaf707e767a
    type: derived
status: test
description: This rule flags process creation events where the executable matches SystemInformer.exe based on image path, file metadata fields, and specific hash values. System Informer can be used to inspect and manipulate processes and low-level system behavior, making it attractive for stealthy discovery or privilege-related activities. The detection relies on Windows process creation telemetry that includes the process image name/path, embedded file properties, and executable hashes.
references:
  - https://github.com/winsiderss/systeminformer
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_system_informer.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2023-05-08
modified: 2024-11-23
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.discovery
  - attack.stealth
  - attack.t1082
  - attack.t1564
  - attack.t1543
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \SystemInformer.exe
    - OriginalFileName: SystemInformer.exe
    - Description: System Informer
    - Product: System Informer
    - Hashes|contains:
        - MD5=19426363A37C03C3ED6FEDF57B6696EC
        - SHA1=8B12C6DA8FAC0D5E8AB999C31E5EA04AF32D53DC
        - SHA256=8EE9D84DE50803545937A63C686822388A3338497CDDB660D5D69CF68B68F287
        - IMPHASH=B68908ADAEB5D662F87F2528AF318F12
  condition: selection
falsepositives:
  - System Informer is regularly used legitimately by system administrators or developers. Apply additional filters accordingly
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL