Windows Process Creation: Detect Sysinternals Tool Name Impersonation by Executable

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions on Windows where the image filename ends with the name of well-known Sysinternals utilities (including 64-bit and ARM64 variants). Attackers may impersonate legitimate Sysinternals binaries by naming malicious executables to blend in and evade allowlists or naive detections. It relies on process creation telemetry with the full image path/filename, filtering out events associated with Sysinternals publisher/product metadata.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Suspicious Child Process Creation from BgInfo.EXE on Windows

Windows: Suspicious Child Process Spawned by VsCode code.exe

Windows WSL Process Spawning Uncommon Child Executables

Windows: Alert on Unusual Child Process of Setres.EXE Spawning 'choice' Executables

Windows ZipExec-Style Suspicious PowerShell/Command Execution with Password-Protected ZIP

Windows: Cmdl32.EXE Arbitrary File Download Indicator via /vpn and /lan Flags

Windows Process Creation: WSL (wsl.exe) Used for Arbitrary Command Execution

Windows renamed dctask64.exe execution via known IMPHASH values

Windows Process Creation: Detect Sysinternals Tool Name Impersonation by Executable

Pivot detection · T1202 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-detect-sysinternals-tool-name-impersonation-by-executab-7cce6fc8

title: "Windows Process Creation: Detect Sysinternals Tool Name Impersonation by Executable"
id: 1633a615-0825-44d1-96e3-edb1a953911a
status: test
description: This rule flags process executions on Windows where the image filename ends with the name of well-known Sysinternals utilities (including 64-bit and ARM64 variants). Attackers may impersonate legitimate Sysinternals binaries by naming malicious executables to blend in and evade allowlists or naive detections. It relies on process creation telemetry with the full image path/filename, filtering out events associated with Sysinternals publisher/product metadata.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_tools_masquerading.yml
author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2021-12-20
modified: 2025-04-12
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218
  - attack.t1202
  - attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_exe:
    Image|endswith:
      - \accesschk.exe
      - \accesschk64.exe
      - \AccessEnum.exe
      - \ADExplorer.exe
      - \ADExplorer64.exe
      - \ADInsight.exe
      - \ADInsight64.exe
      - \adrestore.exe
      - \adrestore64.exe
      - \Autologon.exe
      - \Autologon64.exe
      - \Autoruns.exe
      - \Autoruns64.exe
      - \autorunsc.exe
      - \autorunsc64.exe
      - \Bginfo.exe
      - \Bginfo64.exe
      - \Cacheset.exe
      - \Cacheset64.exe
      - \Clockres.exe
      - \Clockres64.exe
      - \Contig.exe
      - \Contig64.exe
      - \Coreinfo.exe
      - \Coreinfo64.exe
      - \CPUSTRES.EXE
      - \CPUSTRES64.EXE
      - \ctrl2cap.exe
      - \Dbgview.exe
      - \dbgview64.exe
      - \Desktops.exe
      - \Desktops64.exe
      - \disk2vhd.exe
      - \disk2vhd64.exe
      - \diskext.exe
      - \diskext64.exe
      - \Diskmon.exe
      - \Diskmon64.exe
      - \DiskView.exe
      - \DiskView64.exe
      - \du.exe
      - \du64.exe
      - \efsdump.exe
      - \FindLinks.exe
      - \FindLinks64.exe
      - \handle.exe
      - \handle64.exe
      - \hex2dec.exe
      - \hex2dec64.exe
      - \junction.exe
      - \junction64.exe
      - \ldmdump.exe
      - \listdlls.exe
      - \listdlls64.exe
      - \livekd.exe
      - \livekd64.exe
      - \loadOrd.exe
      - \loadOrd64.exe
      - \loadOrdC.exe
      - \loadOrdC64.exe
      - \logonsessions.exe
      - \logonsessions64.exe
      - \movefile.exe
      - \movefile64.exe
      - \notmyfault.exe
      - \notmyfault64.exe
      - \notmyfaultc.exe
      - \notmyfaultc64.exe
      - \ntfsinfo.exe
      - \ntfsinfo64.exe
      - \pendmoves.exe
      - \pendmoves64.exe
      - \pipelist.exe
      - \pipelist64.exe
      - \portmon.exe
      - \procdump.exe
      - \procdump64.exe
      - \procexp.exe
      - \procexp64.exe
      - \Procmon.exe
      - \Procmon64.exe
      - \psExec.exe
      - \psExec64.exe
      - \psfile.exe
      - \psfile64.exe
      - \psGetsid.exe
      - \psGetsid64.exe
      - \psInfo.exe
      - \psInfo64.exe
      - \pskill.exe
      - \pskill64.exe
      - \pslist.exe
      - \pslist64.exe
      - \psLoggedon.exe
      - \psLoggedon64.exe
      - \psloglist.exe
      - \psloglist64.exe
      - \pspasswd.exe
      - \pspasswd64.exe
      - \psping.exe
      - \psping64.exe
      - \psService.exe
      - \psService64.exe
      - \psshutdown.exe
      - \psshutdown64.exe
      - \pssuspend.exe
      - \pssuspend64.exe
      - \RAMMap.exe
      - \RAMMap64.exe
      - \RDCMan.exe
      - \RegDelNull.exe
      - \RegDelNull64.exe
      - \regjump.exe
      - \ru.exe
      - \ru64.exe
      - \sdelete.exe
      - \sdelete64.exe
      - \ShareEnum.exe
      - \ShareEnum64.exe
      - \shellRunas.exe
      - \sigcheck.exe
      - \sigcheck64.exe
      - \streams.exe
      - \streams64.exe
      - \strings.exe
      - \strings64.exe
      - \sync.exe
      - \sync64.exe
      - \Sysmon.exe
      - \Sysmon64.exe
      - \tcpvcon.exe
      - \tcpvcon64.exe
      - \tcpview.exe
      - \tcpview64.exe
      - \Testlimit.exe
      - \Testlimit64.exe
      - \vmmap.exe
      - \vmmap64.exe
      - \Volumeid.exe
      - \Volumeid64.exe
      - \whois.exe
      - \whois64.exe
      - \Winobj.exe
      - \Winobj64.exe
      - \ZoomIt.exe
      - \ZoomIt64.exe
  selection_arm64:
    Image|endswith:
      - \accesschk64a.exe
      - \ADExplorer64a.exe
      - \ADInsight64a.exe
      - \adrestore64a.exe
      - \Autologon64a.exe
      - \Autoruns64a.exe
      - \autorunsc64a.exe
      - \Clockres64a.exe
      - \Contig64a.exe
      - \Coreinfo64a.exe
      - \Dbgview64a.exe
      - \disk2vhd64a.exe
      - \diskext64a.exe
      - \DiskView64a.exe
      - \du64a.exe
      - \FindLinks64a.exe
      - \handle64a.exe
      - \hex2dec64a.exe
      - \junction64a.exe
      - \LoadOrd64a.exe
      - \LoadOrdC64a.exe
      - \logonsessions64a.exe
      - \movefile64a.exe
      - \notmyfault64a.exe
      - \notmyfaultc64a.exe
      - \pendmoves64a.exe
      - \pipelist64a.exe
      - \procdump64a.exe
      - \procexp64a.exe
      - \Procmon64a.exe
      - \PsExec64a.exe
      - \psfile64a.exe
      - \PsGetsid64a.exe
      - \PsInfo64a.exe
      - \pskill64a.exe
      - \psloglist64a.exe
      - \pspasswd64a.exe
      - \psping64a.exe
      - \PsService64a.exe
      - \pssuspend64a.exe
      - \RAMMap64a.exe
      - \RegDelNull64a.exe
      - \ru64a.exe
      - \sdelete64a.exe
      - \sigcheck64a.exe
      - \streams64a.exe
      - \strings64a.exe
      - \sync64a.exe
      - \Sysmon64a.exe
      - \tcpvcon64a.exe
      - \tcpview64a.exe
      - \vmmap64a.exe
      - \whois64a.exe
      - \Winobj64a.exe
      - \ZoomIt64a.exe
  filter_valid:
    - Company:
        - Sysinternals - www.sysinternals.com
        - Sysinternals
    - Product|startswith: Sysinternals
  filter_empty:
    - Company: null
    - Product: null
  condition: 1 of selection_* and not 1 of filter_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 7cce6fc8-a07f-4d84-a53e-96e1879843c9
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL