Windows AppX Execution of Sysinternals Tools (procdump/psloglist/psexec/livekd/ADExplorer)
Flags execution of common Sysinternals binaries when launched through the Windows AppX runtime.
FreeReviewedSigma · Low · v2
- Product
- windows
- Service
- appmodel-runtime
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-16
- Updated
- 2026-07-31
What it detects
This rule identifies execution of specific Sysinternals executables when they run from an AppX package context on Windows. Attackers may use Sysinternals utilities to execute actions like process inspection or remote execution while blending into non-standard application paths. It relies on Windows AppModel runtime telemetry that records process execution with matching image names for the listed tools.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-execution-of-sysinternals-tools-via-appx-package-d29a20b2
title: Windows AppX Execution of Sysinternals Tools (procdump/psloglist/psexec/livekd/ADExplorer)
id: 8b77f987-1c64-42f4-8f0b-3b4a3b846782
status: test
description: This rule identifies execution of specific Sysinternals executables when they run from an AppX package context on Windows. Attackers may use Sysinternals utilities to execute actions like process inspection or remote execution while blending into non-standard application paths. It relies on Windows AppModel runtime telemetry that records process execution with matching image names for the listed tools.
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/microsoft-store
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appmodel_runtime/win_appmodel_runtime_sysinternals_tools_appx_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-16
modified: 2023-09-12
tags:
- attack.execution
- attack.stealth
logsource:
product: windows
service: appmodel-runtime
detection:
selection:
EventID: 201
ImageName:
- procdump.exe
- psloglist.exe
- psexec.exe
- livekd.exe
- ADExplorer.exe
condition: selection
falsepositives:
- Legitimate usage of sysinternals applications from the Windows Store will trigger this. Apply exclusions as needed.
level: low
license: DRL-1.1
related:
- id: d29a20b2-be4b-4827-81f2-3d8a59eab5fc
type: derived