Windows: Detect SysAid user.exe Loader Execution by Filename and SHA256 Hash
Flags execution of a specific SysAid-hosted Windows binary when the process image path and SHA256 match.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-11-09
- Updated
- 2026-07-31
What it detects
This rule identifies execution of a specific SysAid Server Tomcat webapp binary by matching its full filename and a known SHA256 hash. Such targeted loader execution is a key step in delivering additional malicious payloads, so reliably detecting it can expose early compromise activity. Telemetry relies on Windows process creation events that include both the executed image path and the file hash.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-sysaid-user-exe-hash-based-malware-loader-execution-745ea50b
title: "Windows: Detect SysAid user.exe Loader Execution by Filename and SHA256 Hash"
id: 53b084c6-1266-4116-a4cd-3e173e86dbdd
status: test
description: This rule identifies execution of a specific SysAid Server Tomcat webapp binary by matching its full filename and a known SHA256 hash. Such targeted loader execution is a key step in delivering additional malicious payloads, so reliably detecting it can expose early compromise activity. Telemetry relies on Windows process creation events that include both the executed image path and the file hash.
references:
- https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Lace-Tempest/proc_creation_win_apt_lace_tempest_loader_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-11-09
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: :\Program Files\SysAidServer\tomcat\webapps\usersfiles\user.exe
selection_hash:
Hashes|contains: SHA256=B5ACF14CDAC40BE590318DEE95425D0746E85B1B7B1CBD14DA66F21F2522BF4D
condition: 1 of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 745ea50b-9673-4ba7-9426-cb45cf4a8e6d
type: derived