huntrule

Windows Process Creation: runexehelper.exe Used as a Proxy

Flags process executions where runexehelper.exe is the parent, suggesting proxy-based launching of other programs.

FreeUnreviewedSigmamediumv1
title: "Windows Process Creation: runexehelper.exe Used as a Proxy"
id: a496a034-8a66-43ba-bd5a-5d9b3ca57f85
status: test
description: This rule alerts when the process parent is runexehelper.exe, indicating it was used to launch another program. Attackers may use this proxy-like behavior to execute payloads via a seemingly legitimate Windows binary and reduce visibility into the true execution chain. The detection relies on Windows process creation telemetry that includes the parent process image path and supports matching parent image names.
references:
  - https://twitter.com/0gtweet/status/1206692239839289344
  - https://lolbas-project.github.io/lolbas/Binaries/Runexehelper/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_runexehelper.yml
author: frack113, Huntrule Team
date: 2022-12-29
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \runexehelper.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: cd71385d-fd9b-4691-9b98-2b1f7e508714
    type: derived

What it detects

This rule alerts when the process parent is runexehelper.exe, indicating it was used to launch another program. Attackers may use this proxy-like behavior to execute payloads via a seemingly legitimate Windows binary and reduce visibility into the true execution chain. The detection relies on Windows process creation telemetry that includes the parent process image path and supports matching parent image names.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.