Windows Process Creation: Detect Sysinternals Tool Name Impersonation by Executable

title: "Windows Process Creation: Detect Sysinternals Tool Name Impersonation by Executable"
id: 1633a615-0825-44d1-96e3-edb1a953911a
status: test
description: This rule flags process executions on Windows where the image filename ends with the name of well-known Sysinternals utilities (including 64-bit and ARM64 variants). Attackers may impersonate legitimate Sysinternals binaries by naming malicious executables to blend in and evade allowlists or naive detections. It relies on process creation telemetry with the full image path/filename, filtering out events associated with Sysinternals publisher/product metadata.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_tools_masquerading.yml
author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2021-12-20
modified: 2025-04-12
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218
  - attack.t1202
  - attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_exe:
    Image|endswith:
      - \accesschk.exe
      - \accesschk64.exe
      - \AccessEnum.exe
      - \ADExplorer.exe
      - \ADExplorer64.exe
      - \ADInsight.exe
      - \ADInsight64.exe
      - \adrestore.exe
      - \adrestore64.exe
      - \Autologon.exe
      - \Autologon64.exe
      - \Autoruns.exe
      - \Autoruns64.exe
      - \autorunsc.exe
      - \autorunsc64.exe
      - \Bginfo.exe
      - \Bginfo64.exe
      - \Cacheset.exe
      - \Cacheset64.exe
      - \Clockres.exe
      - \Clockres64.exe
      - \Contig.exe
      - \Contig64.exe
      - \Coreinfo.exe
      - \Coreinfo64.exe
      - \CPUSTRES.EXE
      - \CPUSTRES64.EXE
      - \ctrl2cap.exe
      - \Dbgview.exe
      - \dbgview64.exe
      - \Desktops.exe
      - \Desktops64.exe
      - \disk2vhd.exe
      - \disk2vhd64.exe
      - \diskext.exe
      - \diskext64.exe
      - \Diskmon.exe
      - \Diskmon64.exe
      - \DiskView.exe
      - \DiskView64.exe
      - \du.exe
      - \du64.exe
      - \efsdump.exe
      - \FindLinks.exe
      - \FindLinks64.exe
      - \handle.exe
      - \handle64.exe
      - \hex2dec.exe
      - \hex2dec64.exe
      - \junction.exe
      - \junction64.exe
      - \ldmdump.exe
      - \listdlls.exe
      - \listdlls64.exe
      - \livekd.exe
      - \livekd64.exe
      - \loadOrd.exe
      - \loadOrd64.exe
      - \loadOrdC.exe
      - \loadOrdC64.exe
      - \logonsessions.exe
      - \logonsessions64.exe
      - \movefile.exe
      - \movefile64.exe
      - \notmyfault.exe
      - \notmyfault64.exe
      - \notmyfaultc.exe
      - \notmyfaultc64.exe
      - \ntfsinfo.exe
      - \ntfsinfo64.exe
      - \pendmoves.exe
      - \pendmoves64.exe
      - \pipelist.exe
      - \pipelist64.exe
      - \portmon.exe
      - \procdump.exe
      - \procdump64.exe
      - \procexp.exe
      - \procexp64.exe
      - \Procmon.exe
      - \Procmon64.exe
      - \psExec.exe
      - \psExec64.exe
      - \psfile.exe
      - \psfile64.exe
      - \psGetsid.exe
      - \psGetsid64.exe
      - \psInfo.exe
      - \psInfo64.exe
      - \pskill.exe
      - \pskill64.exe
      - \pslist.exe
      - \pslist64.exe
      - \psLoggedon.exe
      - \psLoggedon64.exe
      - \psloglist.exe
      - \psloglist64.exe
      - \pspasswd.exe
      - \pspasswd64.exe
      - \psping.exe
      - \psping64.exe
      - \psService.exe
      - \psService64.exe
      - \psshutdown.exe
      - \psshutdown64.exe
      - \pssuspend.exe
      - \pssuspend64.exe
      - \RAMMap.exe
      - \RAMMap64.exe
      - \RDCMan.exe
      - \RegDelNull.exe
      - \RegDelNull64.exe
      - \regjump.exe
      - \ru.exe
      - \ru64.exe
      - \sdelete.exe
      - \sdelete64.exe
      - \ShareEnum.exe
      - \ShareEnum64.exe
      - \shellRunas.exe
      - \sigcheck.exe
      - \sigcheck64.exe
      - \streams.exe
      - \streams64.exe
      - \strings.exe
      - \strings64.exe
      - \sync.exe
      - \sync64.exe
      - \Sysmon.exe
      - \Sysmon64.exe
      - \tcpvcon.exe
      - \tcpvcon64.exe
      - \tcpview.exe
      - \tcpview64.exe
      - \Testlimit.exe
      - \Testlimit64.exe
      - \vmmap.exe
      - \vmmap64.exe
      - \Volumeid.exe
      - \Volumeid64.exe
      - \whois.exe
      - \whois64.exe
      - \Winobj.exe
      - \Winobj64.exe
      - \ZoomIt.exe
      - \ZoomIt64.exe
  selection_arm64:
    Image|endswith:
      - \accesschk64a.exe
      - \ADExplorer64a.exe
      - \ADInsight64a.exe
      - \adrestore64a.exe
      - \Autologon64a.exe
      - \Autoruns64a.exe
      - \autorunsc64a.exe
      - \Clockres64a.exe
      - \Contig64a.exe
      - \Coreinfo64a.exe
      - \Dbgview64a.exe
      - \disk2vhd64a.exe
      - \diskext64a.exe
      - \DiskView64a.exe
      - \du64a.exe
      - \FindLinks64a.exe
      - \handle64a.exe
      - \hex2dec64a.exe
      - \junction64a.exe
      - \LoadOrd64a.exe
      - \LoadOrdC64a.exe
      - \logonsessions64a.exe
      - \movefile64a.exe
      - \notmyfault64a.exe
      - \notmyfaultc64a.exe
      - \pendmoves64a.exe
      - \pipelist64a.exe
      - \procdump64a.exe
      - \procexp64a.exe
      - \Procmon64a.exe
      - \PsExec64a.exe
      - \psfile64a.exe
      - \PsGetsid64a.exe
      - \PsInfo64a.exe
      - \pskill64a.exe
      - \psloglist64a.exe
      - \pspasswd64a.exe
      - \psping64a.exe
      - \PsService64a.exe
      - \pssuspend64a.exe
      - \RAMMap64a.exe
      - \RegDelNull64a.exe
      - \ru64a.exe
      - \sdelete64a.exe
      - \sigcheck64a.exe
      - \streams64a.exe
      - \strings64a.exe
      - \sync64a.exe
      - \Sysmon64a.exe
      - \tcpvcon64a.exe
      - \tcpview64a.exe
      - \vmmap64a.exe
      - \whois64a.exe
      - \Winobj64a.exe
      - \ZoomIt64a.exe
  filter_valid:
    - Company:
        - Sysinternals - www.sysinternals.com
        - Sysinternals
    - Product|startswith: Sysinternals
  filter_empty:
    - Company: null
    - Product: null
  condition: 1 of selection_* and not 1 of filter_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 7cce6fc8-a07f-4d84-a53e-96e1879843c9
    type: derived