{"id":"5722dff1-4bdd-4949-86ab-fbaf707e767a","title":"PUA - System Informer Execution","description":"Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2023-05-08","modified":"2024-11-23","tags":["attack.persistence","attack.privilege-escalation","attack.discovery","attack.stealth","attack.t1082","attack.t1564","attack.t1543"],"technique_ids":["T1082","T1543","T1564"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["System Informer is regularly used legitimately by system administrators or developers. Apply additional filters accordingly"],"references":["https://github.com/winsiderss/systeminformer"],"source_path":"rules/windows/process_creation/proc_creation_win_pua_system_informer.yml","source_sha256":"a699e1b5d2a5b434b68bc1eeb129e8597b2984fd271dd8363cdf96751163e9be","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_system_informer.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PUA - System Informer Execution\nid: 5722dff1-4bdd-4949-86ab-fbaf707e767a\nrelated:\n    - id: 811e0002-b13b-4a15-9d00-a613fce66e42\n      type: similar\nstatus: test\ndescription: Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations\nreferences:\n    - https://github.com/winsiderss/systeminformer\nauthor: Florian Roth (Nextron Systems)\ndate: 2023-05-08\nmodified: 2024-11-23\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.discovery\n    - attack.stealth\n    - attack.t1082\n    - attack.t1564\n    - attack.t1543\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\SystemInformer.exe'\n        - OriginalFileName: 'SystemInformer.exe'\n        - Description: 'System Informer'\n        - Product: 'System Informer'\n        - Hashes|contains:\n              # Note: add other hashes as needed\n              # 3.0.11077.6550\n              - 'MD5=19426363A37C03C3ED6FEDF57B6696EC'\n              - 'SHA1=8B12C6DA8FAC0D5E8AB999C31E5EA04AF32D53DC'\n              - 'SHA256=8EE9D84DE50803545937A63C686822388A3338497CDDB660D5D69CF68B68F287'\n              - 'IMPHASH=B68908ADAEB5D662F87F2528AF318F12'\n    condition: selection\nfalsepositives:\n    - System Informer is regularly used legitimately by system administrators or developers. Apply additional filters accordingly\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","page":"techniques/enterprise/T1082/"},{"key":"enterprise/T1543","id":"T1543","name":"Create or Modify System Process","page":"techniques/enterprise/T1543/"},{"key":"enterprise/T1564","id":"T1564","name":"Hide Artifacts","page":"techniques/enterprise/T1564/"}],"data_path":"data/detection-rules/5722dff1-4bdd-4949-86ab-fbaf707e767a.json","kind":"sigma"}