huntrule

Windows: Renamed Sysinternals DebugView Process Execution

Flags Windows executions labeled as Sysinternals DebugView when the image is not the original Dbgview.exe.

FreeUnreviewedSigmahighv1
title: "Windows: Renamed Sysinternals DebugView Process Execution"
id: 499be6c8-9633-454d-b9ba-a0d8e97fb39c
status: test
description: This rule identifies process creation events where the executable is running as “Sysinternals DebugView” but is not the original file name “Dbgview.exe”. Renamed binaries can evade allowlists and basic detections while still providing the same diagnostic capability to an attacker. It relies on Windows process creation telemetry containing the product name and original file name metadata.
references:
  - https://www.epicturla.com/blog/sysinturla
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_debugview.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-05-28
modified: 2023-02-14
tags:
  - attack.resource-development
  - attack.t1588.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Product: Sysinternals DebugView
  filter:
    OriginalFileName: Dbgview.exe
    Image|endswith: \Dbgview.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: cd764533-2e07-40d6-a718-cfeec7f2da7f
    type: derived

What it detects

This rule identifies process creation events where the executable is running as “Sysinternals DebugView” but is not the original file name “Dbgview.exe”. Renamed binaries can evade allowlists and basic detections while still providing the same diagnostic capability to an attacker. It relies on Windows process creation telemetry containing the product name and original file name metadata.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.