huntrule

Windows Process Masquerading: msdtc.exe and gpsvc.exe launched from Non-System Paths

Alerts on msdtc.exe or gpsvc.exe launched from paths outside Windows System32/SysWOW64.

FreeReviewedSigma · High · v5
Product
windows
Category
process_creation
Author
Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1) (SigmaHQ), DRL 1.1
Published
2020-06-03
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process executions where the image path ends with msdtc.exe or gpsvc.exe, but the executable is not located under the default Windows System32 or SysWOW64 directories. Masquerading with legitimate-sounding system binary names can help attackers blend in and reduce suspicion during execution. The detection relies on Windows process creation telemetry, specifically the executable image path and path prefix/suffix matching.

Reporting behind it

Related detections9 linkedT1036.005 — drag to rearrange
Suspicious Loading of Masqueraded EndpointDlp.dll Backdoor
Suspicious svchost.exe Execution from Public Directory (via process_creation)
Suspicious Process Masquerading as apached via GobRAT Bulbature Implant
Suspicious MicrosoftEdgeUpdate Launched with Dat Config File
Malicious Scheduled Task Masquerading as Defender NisSrv via Schtasks
Malicious PowerShell Masquerading as Windows Terminal in ProgramData (via process_creation)
Suspicious Csrss Process Masquerading Outside System32 (via process_creation)
Suspicious Mimilite Credential Dumper Execution Writing KB-Named Output
Suspicious PikaBot Autorun Persistence Pointing to AppData Microsoft Dropzone via registry_set
Windows Process Masquerading: msdtc.exe and gpsvc.exe launched from Non-System Paths
Pivot detection · T1036.005 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.