Windows Process Creation: GMER Rootkit Tool Execution (gmer.exe)
Flags execution of gmer.exe on Windows when matched by known process hashes.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-05
- Updated
- 2026-07-31
What it detects
This rule identifies execution of the GMER rootkit tool by matching process image paths that end with \gmer.exe and confirming the binary using specific hash values. Attackers may use GMER-like tooling to enumerate or assess rootkit presence, which can indicate stealth-focused activity. It relies on Windows process creation telemetry and available image path and hash fields to correlate the executable.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-gmer-exe-execution-rootkit-tool-via-image-path-and-known-hashes-9082ff1f
title: "Windows Process Creation: GMER Rootkit Tool Execution (gmer.exe)"
id: f9bcfec5-716f-451c-af00-597a2c6ff705
status: test
description: This rule identifies execution of the GMER rootkit tool by matching process image paths that end with \gmer.exe and confirming the binary using specific hash values. Attackers may use GMER-like tooling to enumerate or assess rootkit presence, which can indicate stealth-focused activity. It relies on Windows process creation telemetry and available image path and hash fields to correlate the executable.
references:
- http://www.gmer.net/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_gmer.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-05
modified: 2024-11-23
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: \gmer.exe
selection_sysmon_hash:
Hashes|contains:
- MD5=E9DC058440D321AA17D0600B3CA0AB04
- SHA1=539C228B6B332F5AA523E5CE358C16647D8BBE57
- SHA256=E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173
condition: 1 of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 9082ff1f-88ab-4678-a3cc-5bcff99fc74d
type: derived