Windows Process Monitor Driver (.sys) Created by Non-procmon Executables

Alerts when a procmon-named .sys driver is created by a process other than procmon.

FreeUnreviewedSigmamediumv1

windows-process-monitor-driver-sys-created-by-non-procmon-executables-a05baa88

title: Windows Process Monitor Driver (.sys) Created by Non-procmon Executables
id: 1d5fb565-3aab-4dda-a6de-0c273b5d670b
status: test
description: This rule flags file creation of a .sys driver whose filename contains “\procmon” while the creating process is not one of the allowed Process Monitor executables (procmon.exe/procmon64.exe/procmon64a.exe). Creating or planting a similarly named driver can indicate persistence or privilege escalation attempts leveraging trusted-looking components. It relies on Windows file event telemetry that includes the target filename and the creating process image path to distinguish legitimate procmon activity from other creators.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_sysinternals_procmon_driver_susp_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-05
modified: 2026-06-29
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1068
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains: \procmon
    TargetFilename|endswith: .sys
  filter_main_process_explorer:
    Image|endswith:
      - \procmon.exe
      - \procmon64.exe
      - \procmon64a.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Some false positives may occur with legitimate renamed process monitor binaries
level: medium
license: DRL-1.1
related:
  - id: a05baa88-e922-4001-bc4d-8738135f27de
    type: derived

What it detects

This rule flags file creation of a .sys driver whose filename contains “\procmon” while the creating process is not one of the allowed Process Monitor executables (procmon.exe/procmon64.exe/procmon64a.exe). Creating or planting a similarly named driver can indicate persistence or privilege escalation attempts leveraging trusted-looking components. It relies on Windows file event telemetry that includes the target filename and the creating process image path to distinguish legitimate procmon activity from other creators.

Known false positives

Some false positives may occur with legitimate renamed process monitor binaries

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.