Windows: Renamed Sysinternals DebugView Process Execution
Flags Windows executions labeled as Sysinternals DebugView when the image is not the original Dbgview.exe.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2020-05-28
- Updated
- 2026-07-30
ATT&CK techniques
Resource DevRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation events where the executable is running as “Sysinternals DebugView” but is not the original file name “Dbgview.exe”. Renamed binaries can evade allowlists and basic detections while still providing the same diagnostic capability to an attacker. It relies on Windows process creation telemetry containing the product name and original file name metadata.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Renamed Sysinternals DebugView Process Execution"
id: 499be6c8-9633-454d-b9ba-a0d8e97fb39c
status: test
description: This rule identifies process creation events where the executable is running as “Sysinternals DebugView” but is not the original file name “Dbgview.exe”. Renamed binaries can evade allowlists and basic detections while still providing the same diagnostic capability to an attacker. It relies on Windows process creation telemetry containing the product name and original file name metadata.
references:
- https://www.epicturla.com/blog/sysinturla
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_debugview.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-05-28
modified: 2023-02-14
tags:
- attack.resource-development
- attack.t1588.002
logsource:
category: process_creation
product: windows
detection:
selection:
Product: Sysinternals DebugView
filter:
OriginalFileName: Dbgview.exe
Image|endswith: \Dbgview.exe
condition: selection and not filter
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: cd764533-2e07-40d6-a718-cfeec7f2da7f
type: derived