huntrule

Windows Process Execution: hostname.exe Run Matching

Flags execution of hostname.exe from process creation events on Windows for discovery activity.

FreeUnreviewedSigmalowv1
title: "Windows Process Execution: hostname.exe Run Matching"
id: fc0a899c-9de5-4140-a333-e36001b390e0
status: test
description: This rule matches process creation events where the executed image ends with \HOSTNAME.EXE, indicating the hostname discovery command was launched. Attackers commonly use hostname output to inform subsequent targeting, environment checks, or workflow decisions during discovery. The detection relies on Windows process creation telemetry, including the process image path or name.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-6---hostname-discovery-windows
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/hostname
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hostname_execution.yml
author: frack113, Huntrule Team
date: 2022-01-01
tags:
  - attack.discovery
  - attack.t1082
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \HOSTNAME.EXE
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 7be5fb68-f9ef-476d-8b51-0256ebece19e
    type: derived

What it detects

This rule matches process creation events where the executed image ends with \HOSTNAME.EXE, indicating the hostname discovery command was launched. Attackers commonly use hostname output to inform subsequent targeting, environment checks, or workflow decisions during discovery. The detection relies on Windows process creation telemetry, including the process image path or name.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.