Windows: Executed hxtsr.exe from outside Microsoft.WindowsCommunicationsApps WindowsApps path

Alerts when hxtsr.exe runs from a non-expected WindowsApps Microsoft.WindowsCommunicationsApps location.

FreeUnreviewedSigmamediumv1

windows-executed-hxtsr-exe-from-outside-microsoft-windowscommunicationsapps-wind-4e762605

title: "Windows: Executed hxtsr.exe from outside Microsoft.WindowsCommunicationsApps WindowsApps path"
id: c0a956bc-0d37-477e-9471-3a0a2a24571a
status: test
description: This rule flags process creation events where the executable name ends with hxtsr.exe but the full image path is not within a specific hidden WindowsApps Microsoft.WindowsCommunicationsApps_ subfolder. Attackers may use this filename camouflage to impersonate a legitimate Outlook Communications component. The detection relies on Windows process creation telemetry, matching the executable path string on Image and filtering for the expected directory context.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hxtsr_masquerading.yml
author: Sreeman, Huntrule Team
date: 2020-04-17
modified: 2024-02-08
tags:
  - attack.stealth
  - attack.t1036
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: \hxtsr.exe
  filter_main_hxtsr:
    Image|contains: :\program files\windowsapps\microsoft.windowscommunicationsapps_
    Image|endswith: \hxtsr.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4e762605-34a8-406d-b72e-c1a089313320
    type: derived

What it detects

This rule flags process creation events where the executable name ends with hxtsr.exe but the full image path is not within a specific hidden WindowsApps Microsoft.WindowsCommunicationsApps_ subfolder. Attackers may use this filename camouflage to impersonate a legitimate Outlook Communications component. The detection relies on Windows process creation telemetry, matching the executable path string on Image and filtering for the expected directory context.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.