huntrule

Windows Process Creation: SysAid user.exe Hash-Based Malware Loader Execution

Flags execution of a specific SysAid-hosted Windows binary when the process image path and SHA256 match.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: SysAid user.exe Hash-Based Malware Loader Execution"
id: 53b084c6-1266-4116-a4cd-3e173e86dbdd
status: test
description: This rule identifies execution of a specific Windows binary by matching both the executable path ending with SysAidServer\tomcat\webapps\usersfiles\user.exe and a known SHA256 hash. Attackers can use this staged loader behavior to run additional malware from a legitimate-looking application directory. The detection relies on Windows process creation telemetry that includes the Image path and file hash values.
references:
  - https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Lace-Tempest/proc_creation_win_apt_lace_tempest_loader_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-11-09
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: :\Program Files\SysAidServer\tomcat\webapps\usersfiles\user.exe
  selection_hash:
    Hashes|contains: SHA256=B5ACF14CDAC40BE590318DEE95425D0746E85B1B7B1CBD14DA66F21F2522BF4D
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 745ea50b-9673-4ba7-9426-cb45cf4a8e6d
    type: derived

What it detects

This rule identifies execution of a specific Windows binary by matching both the executable path ending with SysAidServer\tomcat\webapps\usersfiles\user.exe and a known SHA256 hash. Attackers can use this staged loader behavior to run additional malware from a legitimate-looking application directory. The detection relies on Windows process creation telemetry that includes the Image path and file hash values.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.