Windows: Suspicious Process Execution of hostname.exe

Flags execution of hostname.exe from process creation events on Windows for discovery activity.

FreeReviewedSigma · Low · v2

Product: windows
Category: process_creation
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-01-01
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1082System Information Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions where the binary path ends with \HOSTNAME.EXE, indicating a hostname discovery attempt on Windows. Attackers often use hostname-related commands to gather local or system context before further discovery or targeting. It relies on process creation telemetry containing the executed image path.

Reporting behind it

Related detections9 linkedT1082 — drag to rearrange

Suspicious System Profiler Hardware Enumeration (via process_creation)

Suspicious Hardware Inventory Discovery via WMIC Device Class Queries (via process_creation)

Suspicious macOS Hardware Identifier Reconnaissance via ioreg (via process_creation)

Suspicious Encoded PowerShell Host Reconnaissance via Get-ComputerInfo via ps_script

Suspicious Host Recon via ConvertFrom-Csv and ConvertTo-Json

Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)

Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server

Suspicious macOS Download History Query via sqlite3

Suspicious Security Policy Export via SecEdit (via process_creation)

Windows: Suspicious Process Execution of hostname.exe

Pivot detection · T1082 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-hostname-exe-run-matching-7be5fb68

title: "Windows: Suspicious Process Execution of hostname.exe"
id: fc0a899c-9de5-4140-a333-e36001b390e0
status: test
description: This rule flags process executions where the binary path ends with \HOSTNAME.EXE, indicating a hostname discovery attempt on Windows. Attackers often use hostname-related commands to gather local or system context before further discovery or targeting. It relies on process creation telemetry containing the executed image path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-6---hostname-discovery-windows
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/hostname
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hostname_execution.yml
author: frack113, Huntrule Team
date: 2022-01-01
tags:
  - attack.discovery
  - attack.t1082
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \HOSTNAME.EXE
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 7be5fb68-f9ef-476d-8b51-0256ebece19e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL