Windows Process Creation: OpenConsole.exe Used as LOLBIN to Launch Other Executables

Alerts when OpenConsole.exe runs (outside a specific Windows Terminal path), potentially used to bypass application whitelisting.

FreeUnreviewedSigmamediumv1

windows-process-creation-openconsole-exe-used-as-lolbin-to-launch-other-executab-814c95cc

title: "Windows Process Creation: OpenConsole.exe Used as LOLBIN to Launch Other Executables"
id: fe45a3c8-cf98-4569-af75-f02788579d67
status: test
description: This rule flags process creation events where OpenConsole.exe is executed from a path other than the excluded Windows Terminal default location. Adversaries may use OpenConsole as a living-off-the-land binary to run additional executables while attempting to evade application allowlisting controls. The detection relies on process creation telemetry, matching the OriginalFileName and the executed image path ending in \OpenConsole.exe, and excluding a specific WindowsApps-based directory.
references:
  - https://twitter.com/nas_bench/status/1537563834478645252
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_openconsole.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-16
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - OriginalFileName: OpenConsole.exe
    - Image|endswith: \OpenConsole.exe
  filter:
    Image|startswith: C:\Program Files\WindowsApps\Microsoft.WindowsTerminal
  condition: selection and not filter
falsepositives:
  - Legitimate use by an administrator
level: medium
license: DRL-1.1
related:
  - id: 814c95cc-8192-4378-a70a-f1aafd877af1
    type: derived

What it detects

This rule flags process creation events where OpenConsole.exe is executed from a path other than the excluded Windows Terminal default location. Adversaries may use OpenConsole as a living-off-the-land binary to run additional executables while attempting to evade application allowlisting controls. The detection relies on process creation telemetry, matching the OriginalFileName and the executed image path ending in \OpenConsole.exe, and excluding a specific WindowsApps-based directory.

Known false positives

Legitimate use by an administrator

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.