Windows: ps.exe CommandLine Renaming of SysInternals PsTool Execution

Alerts on Windows executions of renamed PsTool-like ps.exe that include accept-eula and netstat via cmd.exe.

FreeUnreviewedSigmahighv1

windows-ps-exe-commandline-renaming-of-sysinternals-pstool-execution-18da1007

title: "Windows: ps.exe CommandLine Renaming of SysInternals PsTool Execution"
id: 2fd03545-218d-44bd-ab75-9ae00167a38b
status: test
description: This rule flags Windows process creation where the command line contains the PsTool-style accept-eula string and runs a netstat command via cmd.exe. Attackers may rename commonly used SysInternals binaries to reduce visibility while preserving their functionality for system discovery. Detection relies on process creation telemetry including full command lines.
references:
  - https://www.us-cert.gov/ncas/alerts/TA17-293A
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/TA/Dragonfly/proc_creation_win_apt_ta17_293a_ps.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-10-22
modified: 2023-05-02
tags:
  - attack.stealth
  - attack.g0035
  - attack.t1036.003
  - car.2013-05-009
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - ps.exe -accepteula
      - -s cmd /c netstat
  condition: selection
falsepositives:
  - Renamed SysInternals tool
level: high
license: DRL-1.1
related:
  - id: 18da1007-3f26-470f-875d-f77faf1cab31
    type: derived

What it detects

This rule flags Windows process creation where the command line contains the PsTool-style accept-eula string and runs a netstat command via cmd.exe. Attackers may rename commonly used SysInternals binaries to reduce visibility while preserving their functionality for system discovery. Detection relies on process creation telemetry including full command lines.

Known false positives

Renamed SysInternals tool

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.