Windows: Execution of Sysinternals Tools via AppX package

Flags execution of common Sysinternals binaries when launched through the Windows AppX runtime.

FreeUnreviewedSigmalowv1

windows-execution-of-sysinternals-tools-via-appx-package-d29a20b2

title: "Windows: Execution of Sysinternals Tools via AppX package"
id: 8b77f987-1c64-42f4-8f0b-3b4a3b846782
status: test
description: This rule identifies executions of specific Sysinternals binaries (procdump.exe, psloglist.exe, psexec.exe, livekd.exe, ADExplorer.exe) when reported by the AppX runtime service. Attackers may use Sysinternals tools to perform discovery or credential/process-related activity while bypassing expectations tied to standard system paths. It relies on Windows telemetry from appmodel-runtime events that capture the executable name.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/microsoft-store
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appmodel_runtime/win_appmodel_runtime_sysinternals_tools_appx_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-16
modified: 2023-09-12
tags:
  - attack.execution
  - attack.stealth
logsource:
  product: windows
  service: appmodel-runtime
detection:
  selection:
    EventID: 201
    ImageName:
      - procdump.exe
      - psloglist.exe
      - psexec.exe
      - livekd.exe
      - ADExplorer.exe
  condition: selection
falsepositives:
  - Legitimate usage of sysinternals applications from the Windows Store will trigger this. Apply exclusions as needed.
level: low
license: DRL-1.1
related:
  - id: d29a20b2-be4b-4827-81f2-3d8a59eab5fc
    type: derived

What it detects

This rule identifies executions of specific Sysinternals binaries (procdump.exe, psloglist.exe, psexec.exe, livekd.exe, ADExplorer.exe) when reported by the AppX runtime service. Attackers may use Sysinternals tools to perform discovery or credential/process-related activity while bypassing expectations tied to standard system paths. It relies on Windows telemetry from appmodel-runtime events that capture the executable name.

Known false positives

Legitimate usage of sysinternals applications from the Windows Store will trigger this. Apply exclusions as needed.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.