{"id":"3da70954-0f2c-4103-adff-b7440368f50e","title":"Suspicious PROCEXP152.sys File Created In TMP","description":"Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder.\nThis driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU.\n","author":"xknow (@xknow_infosec), xorxes (@xor_xes)","status":"test","level":"medium","date":"2019-04-08","modified":"2022-11-22","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Other legimate tools using this driver and filename (like Sysinternals). Note - Clever attackers may easily bypass this detection by just renaming the driver filename. Therefore just Medium-level and don't rely on it."],"references":["https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/"],"source_path":"rules/windows/file/file_event/file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml","source_sha256":"b61a46ad054017ec229e36255a1feb4afacc9f8e6167aaa001410cba0603f73b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious PROCEXP152.sys File Created In TMP\nid: 3da70954-0f2c-4103-adff-b7440368f50e\nstatus: test\ndescription: |\n  Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder.\n  This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU.\nreferences:\n    - https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/\nauthor: xknow (@xknow_infosec), xorxes (@xor_xes)\ndate: 2019-04-08\nmodified: 2022-11-22\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        TargetFilename|contains: '\\AppData\\Local\\Temp\\'\n        TargetFilename|endswith: 'PROCEXP152.sys'\n    filter:\n        Image|contains:\n            - '\\procexp64.exe'\n            - '\\procexp.exe'\n            - '\\procmon64.exe'\n            - '\\procmon.exe'\n    condition: selection and not filter\nfalsepositives:\n    - Other legimate tools using this driver and filename (like Sysinternals). Note - Clever attackers may easily bypass this detection by just renaming the driver filename. Therefore just Medium-level and don't rely on it.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/3da70954-0f2c-4103-adff-b7440368f50e.json","kind":"sigma"}