Windows DirLister.exe execution for directory and file discovery

Alerts on execution of DirLister.exe on Windows, indicating potential directory/file discovery activity.

FreeUnreviewedSigmalowv1

windows-dirlister-exe-execution-for-directory-and-file-discovery-b4dc61f5

title: Windows DirLister.exe execution for directory and file discovery
id: 96ae91e7-4fe2-4b5e-9f54-b6bf9bf5e05b
status: test
description: This rule flags process creation events where DirLister.exe is executed, using either the OriginalFileName field or an Image path ending with \DirLister.exe. Attackers may use this tool to quickly enumerate accessible directories and files to support discovery and subsequent targeting decisions. The detection relies on Windows process creation telemetry that includes process image path and OriginalFileName metadata.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1083/T1083.md
  - https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dirlister_execution.yml
author: frack113, Huntrule Team
date: 2022-08-20
modified: 2023-02-04
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - OriginalFileName: DirLister.exe
    - Image|endswith: \DirLister.exe
  condition: selection
falsepositives:
  - Legitimate use by users
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dirlister_execution/info.yml
simulation:
  - type: atomic-red-team
    name: Launch DirLister Executable
    technique: T1083
    atomic_guid: c5bec457-43c9-4a18-9a24-fe151d8971b7
license: DRL-1.1
related:
  - id: b4dc61f5-6cce-468e-a608-b48b469feaa2
    type: derived

What it detects

This rule flags process creation events where DirLister.exe is executed, using either the OriginalFileName field or an Image path ending with \DirLister.exe. Attackers may use this tool to quickly enumerate accessible directories and files to support discovery and subsequent targeting decisions. The detection relies on Windows process creation telemetry that includes process image path and OriginalFileName metadata.

Known false positives

Legitimate use by users

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.