Windows AppX Execution of Sysinternals Tools (procdump/psloglist/psexec/livekd/ADExplorer)

title: Windows AppX Execution of Sysinternals Tools (procdump/psloglist/psexec/livekd/ADExplorer)
id: 8b77f987-1c64-42f4-8f0b-3b4a3b846782
status: test
description: This rule identifies execution of specific Sysinternals executables when they run from an AppX package context on Windows. Attackers may use Sysinternals utilities to execute actions like process inspection or remote execution while blending into non-standard application paths. It relies on Windows AppModel runtime telemetry that records process execution with matching image names for the listed tools.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/microsoft-store
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appmodel_runtime/win_appmodel_runtime_sysinternals_tools_appx_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-16
modified: 2023-09-12
tags:
  - attack.execution
  - attack.stealth
logsource:
  product: windows
  service: appmodel-runtime
detection:
  selection:
    EventID: 201
    ImageName:
      - procdump.exe
      - psloglist.exe
      - psexec.exe
      - livekd.exe
      - ADExplorer.exe
  condition: selection
falsepositives:
  - Legitimate usage of sysinternals applications from the Windows Store will trigger this. Apply exclusions as needed.
level: low
license: DRL-1.1
related:
  - id: d29a20b2-be4b-4827-81f2-3d8a59eab5fc
    type: derived