huntrule

Windows: Renamed Sysinternals DebugView Process Execution

Flags Windows executions labeled as Sysinternals DebugView when the image is not the original Dbgview.exe.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2020-05-28
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Resource Dev

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies process creation events where the executable is running as “Sysinternals DebugView” but is not the original file name “Dbgview.exe”. Renamed binaries can evade allowlists and basic detections while still providing the same diagnostic capability to an attacker. It relies on Windows process creation telemetry containing the product name and original file name metadata.

Reporting behind it

Related detections9 linkedT1588.002 — drag to rearrange
Malicious Viper C2 Installation via f8x One-Liner Setup Script (via process_creation)
Windows RegistrySet: EulaAccepted set for renamed Sysinternals tools
Windows Registry Set: Sysinternals EULA Accepted Key for PUA Tool Execution
Windows Registry: Sysinternals Renamed Tool Execution Indicator via EulaAccepted Key
Windows Hacktool Execution via PE Metadata Company Field
Windows Hacktool Execution Flagged by Imphash in Process Creation
Windows Registry: Suspicious Keyboard Layout Preload in User Session
Windows Registry Key Created: Sysinternals EULA Acceptance
Windows: Command-line execution using Sysinternals -accepteula flag
Windows: Renamed Sysinternals DebugView Process Execution
Pivot detection · T1588.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.