huntrule

Windows: Alert on PROCEXP152.sys Driver Created in AppData Local Temp

Flags creation of PROCEXP152.sys in AppData\Local\Temp, excluding events from common Sysinternals executables.

FreeUnreviewedSigmamediumv1
title: "Windows: Alert on PROCEXP152.sys Driver Created in AppData Local Temp"
id: 665ab2d4-bf80-4110-851b-7d155bc9d536
status: test
description: This rule identifies creation of the PROCEXP152.sys file within the application data local temporary directory. Attackers may use process-monitoring or driver components to impair defenses, and naming this specific driver in a temp location can indicate suspicious staging. It relies on file creation telemetry, matching the target path containing \AppData\Local\Temp\ and the filename ending with PROCEXP152.sys, excluding events where the creating image is a known Sysinternals Process Explorer/ProcMon executable.
references:
  - https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml
author: xknow (@xknow_infosec), xorxes (@xor_xes), Huntrule Team
date: 2019-04-08
modified: 2026-06-29
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains: \AppData\Local\Temp\
    TargetFilename|endswith: PROCEXP152.sys
  filter:
    Image|contains:
      - \procexp64.exe
      - \procexp64a.exe
      - \procexp.exe
      - \procmon64.exe
      - \procmon64a.exe
      - \procmon.exe
  condition: selection and not filter
falsepositives:
  - Other legimate tools using this driver and filename (like Sysinternals). Note - Clever attackers may easily bypass this detection by just renaming the driver filename. Therefore just Medium-level and don't rely on it.
level: medium
license: DRL-1.1
related:
  - id: 3da70954-0f2c-4103-adff-b7440368f50e
    type: derived

What it detects

This rule identifies creation of the PROCEXP152.sys file within the application data local temporary directory. Attackers may use process-monitoring or driver components to impair defenses, and naming this specific driver in a temp location can indicate suspicious staging. It relies on file creation telemetry, matching the target path containing \AppData\Local\Temp\ and the filename ending with PROCEXP152.sys, excluding events where the creating image is a known Sysinternals Process Explorer/ProcMon executable.

Known false positives

  • Other legimate tools using this driver and filename (like Sysinternals). Note - Clever attackers may easily bypass this detection by just renaming the driver filename. Therefore just Medium-level and don't rely on it.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.