huntrule

Windows SysmonEOP HackTool Execution via SysmonEOP.exe Name and IMPhash

Alert on Windows process execution of \SysmonEOP.exe with specific IMPhashes associated with the SysmonEOP PoC.

FreeUnreviewedSigmacriticalv1
title: Windows SysmonEOP HackTool Execution via SysmonEOP.exe Name and IMPhash
id: d2fce273-452e-42e4-870a-1521888828d0
status: test
description: This rule flags execution of the SysmonEOP proof-of-concept tool by matching process image name ending with \SysmonEOP.exe and correlating with known file IMPhashes. Such tooling is commonly used to attempt privilege escalation by triggering behavior related to a specific Sysmon vulnerability. It relies on Windows process creation telemetry, including the process image path and computed hash values (IMPhASH).
references:
  - https://github.com/Wh04m1001/SysmonEoP
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sysmoneop.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-12-04
modified: 2024-11-23
tags:
  - cve.2022-41120
  - attack.t1068
  - attack.privilege-escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \SysmonEOP.exe
  selection_hash:
    Hashes|contains:
      - IMPHASH=22F4089EB8ABA31E1BB162C6D9BF72E5
      - IMPHASH=5123FA4C4384D431CD0D893EEB49BBEC
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 8a7e90c5-fe6e-45dc-889e-057fe4378bd9
    type: derived

What it detects

This rule flags execution of the SysmonEOP proof-of-concept tool by matching process image name ending with \SysmonEOP.exe and correlating with known file IMPhashes. Such tooling is commonly used to attempt privilege escalation by triggering behavior related to a specific Sysmon vulnerability. It relies on Windows process creation telemetry, including the process image path and computed hash values (IMPhASH).

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.