{"id":"7cce6fc8-a07f-4d84-a53e-96e1879843c9","title":"Potential Binary Impersonating Sysinternals Tools","description":"Detects binaries that use the same name as legitimate sysinternals tools to evade detection.\nThis rule looks for the execution of binaries that are named similarly to Sysinternals tools.\nAdversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.\n","author":"frack113, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"medium","date":"2021-12-20","modified":"2025-04-12","tags":["attack.execution","attack.stealth","attack.t1218","attack.t1202","attack.t1036.005"],"technique_ids":["T1036.005","T1202","T1218"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite"],"source_path":"rules/windows/process_creation/proc_creation_win_sysinternals_tools_masquerading.yml","source_sha256":"1481384429fcc76c78f0f9546c3f9fa6b48bb3921ef565299912161cc54b37c0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysinternals_tools_masquerading.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Binary Impersonating Sysinternals Tools\nid: 7cce6fc8-a07f-4d84-a53e-96e1879843c9\nstatus: test\ndescription: |\n    Detects binaries that use the same name as legitimate sysinternals tools to evade detection.\n    This rule looks for the execution of binaries that are named similarly to Sysinternals tools.\n    Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.\nreferences:\n    - https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite\nauthor: frack113, Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2021-12-20\nmodified: 2025-04-12\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1218\n    - attack.t1202\n    - attack.t1036.005\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_exe:\n        Image|endswith:\n            - '\\accesschk.exe'\n            - '\\accesschk64.exe'\n            - '\\AccessEnum.exe'\n            - '\\ADExplorer.exe'\n            - '\\ADExplorer64.exe'\n            - '\\ADInsight.exe'\n            - '\\ADInsight64.exe'\n            - '\\adrestore.exe'\n            - '\\adrestore64.exe'\n            - '\\Autologon.exe'\n            - '\\Autologon64.exe'\n            - '\\Autoruns.exe'\n            - '\\Autoruns64.exe'\n            - '\\autorunsc.exe'\n            - '\\autorunsc64.exe'\n            - '\\Bginfo.exe'\n            - '\\Bginfo64.exe'\n            - '\\Cacheset.exe'\n            - '\\Cacheset64.exe'\n            - '\\Clockres.exe'\n            - '\\Clockres64.exe'\n            - '\\Contig.exe'\n            - '\\Contig64.exe'\n            - '\\Coreinfo.exe'\n            - '\\Coreinfo64.exe'\n            - '\\CPUSTRES.EXE'\n            - '\\CPUSTRES64.EXE'\n            - '\\ctrl2cap.exe'\n            - '\\Dbgview.exe'\n            - '\\dbgview64.exe'\n            - '\\Desktops.exe'\n            - '\\Desktops64.exe'\n            - '\\disk2vhd.exe'\n            - '\\disk2vhd64.exe'\n            - '\\diskext.exe'\n            - '\\diskext64.exe'\n            - '\\Diskmon.exe'\n            - '\\Diskmon64.exe'\n            - '\\DiskView.exe'\n            - '\\DiskView64.exe'\n            - '\\du.exe'\n            - '\\du64.exe'\n            - '\\efsdump.exe'\n            - '\\FindLinks.exe'\n            - '\\FindLinks64.exe'\n            - '\\handle.exe'\n            - '\\handle64.exe'\n            - '\\hex2dec.exe'\n            - '\\hex2dec64.exe'\n            - '\\junction.exe'\n            - '\\junction64.exe'\n            - '\\ldmdump.exe'\n            - '\\listdlls.exe'\n            - '\\listdlls64.exe'\n            - '\\livekd.exe'\n            - '\\livekd64.exe'\n            - '\\loadOrd.exe'\n            - '\\loadOrd64.exe'\n            - '\\loadOrdC.exe'\n            - '\\loadOrdC64.exe'\n            - '\\logonsessions.exe'\n            - '\\logonsessions64.exe'\n            - '\\movefile.exe'\n            - '\\movefile64.exe'\n            - '\\notmyfault.exe'\n            - '\\notmyfault64.exe'\n            - '\\notmyfaultc.exe'\n            - '\\notmyfaultc64.exe'\n            - '\\ntfsinfo.exe'\n            - '\\ntfsinfo64.exe'\n            - '\\pendmoves.exe'\n            - '\\pendmoves64.exe'\n            - '\\pipelist.exe'\n            - '\\pipelist64.exe'\n            - '\\portmon.exe'\n            - '\\procdump.exe'\n            - '\\procdump64.exe'\n            - '\\procexp.exe'\n            - '\\procexp64.exe'\n            - '\\Procmon.exe'\n            - '\\Procmon64.exe'\n            - '\\psExec.exe'\n            - '\\psExec64.exe'\n            - '\\psfile.exe'\n            - '\\psfile64.exe'\n            - '\\psGetsid.exe'\n            - '\\psGetsid64.exe'\n            - '\\psInfo.exe'\n            - '\\psInfo64.exe'\n            - '\\pskill.exe'\n            - '\\pskill64.exe'\n            - '\\pslist.exe'\n            - '\\pslist64.exe'\n            - '\\psLoggedon.exe'\n            - '\\psLoggedon64.exe'\n            - '\\psloglist.exe'\n            - '\\psloglist64.exe'\n            - '\\pspasswd.exe'\n            - '\\pspasswd64.exe'\n            - '\\psping.exe'\n            - '\\psping64.exe'\n            - '\\psService.exe'\n            - '\\psService64.exe'\n            - '\\psshutdown.exe'\n            - '\\psshutdown64.exe'\n            - '\\pssuspend.exe'\n            - '\\pssuspend64.exe'\n            - '\\RAMMap.exe'\n            - '\\RAMMap64.exe'\n            - '\\RDCMan.exe'\n            - '\\RegDelNull.exe'\n            - '\\RegDelNull64.exe'\n            - '\\regjump.exe'\n            - '\\ru.exe'\n            - '\\ru64.exe'\n            - '\\sdelete.exe'\n            - '\\sdelete64.exe'\n            - '\\ShareEnum.exe'\n            - '\\ShareEnum64.exe'\n            - '\\shellRunas.exe'\n            - '\\sigcheck.exe'\n            - '\\sigcheck64.exe'\n            - '\\streams.exe'\n            - '\\streams64.exe'\n            - '\\strings.exe'\n            - '\\strings64.exe'\n            - '\\sync.exe'\n            - '\\sync64.exe'\n            - '\\Sysmon.exe'\n            - '\\Sysmon64.exe'\n            - '\\tcpvcon.exe'\n            - '\\tcpvcon64.exe'\n            - '\\tcpview.exe'\n            - '\\tcpview64.exe'\n            - '\\Testlimit.exe'\n            - '\\Testlimit64.exe'\n            - '\\vmmap.exe'\n            - '\\vmmap64.exe'\n            - '\\Volumeid.exe'\n            - '\\Volumeid64.exe'\n            - '\\whois.exe'\n            - '\\whois64.exe'\n            - '\\Winobj.exe'\n            - '\\Winobj64.exe'\n            - '\\ZoomIt.exe'\n            - '\\ZoomIt64.exe'\n    selection_arm64:\n        Image|endswith:\n            - '\\accesschk64a.exe'\n            - '\\ADExplorer64a.exe'\n            - '\\ADInsight64a.exe'\n            - '\\adrestore64a.exe'\n            - '\\Autologon64a.exe'\n            - '\\Autoruns64a.exe'\n            - '\\autorunsc64a.exe'\n            - '\\Clockres64a.exe'\n            - '\\Contig64a.exe'\n            - '\\Coreinfo64a.exe'\n            - '\\Dbgview64a.exe'\n            - '\\disk2vhd64a.exe'\n            - '\\diskext64a.exe'\n            - '\\DiskView64a.exe'\n            - '\\du64a.exe'\n            - '\\FindLinks64a.exe'\n            - '\\handle64a.exe'\n            - '\\hex2dec64a.exe'\n            - '\\junction64a.exe'\n            - '\\LoadOrd64a.exe'\n            - '\\LoadOrdC64a.exe'\n            - '\\logonsessions64a.exe'\n            - '\\movefile64a.exe'\n            - '\\notmyfault64a.exe'\n            - '\\notmyfaultc64a.exe'\n            - '\\pendmoves64a.exe'\n            - '\\pipelist64a.exe'\n            - '\\procdump64a.exe'\n            - '\\procexp64a.exe'\n            - '\\Procmon64a.exe'\n            - '\\PsExec64a.exe'\n            - '\\psfile64a.exe'\n            - '\\PsGetsid64a.exe'\n            - '\\PsInfo64a.exe'\n            - '\\pskill64a.exe'\n            - '\\psloglist64a.exe'\n            - '\\pspasswd64a.exe'\n            - '\\psping64a.exe'\n            - '\\PsService64a.exe'\n            - '\\pssuspend64a.exe'\n            - '\\RAMMap64a.exe'\n            - '\\RegDelNull64a.exe'\n            - '\\ru64a.exe'\n            - '\\sdelete64a.exe'\n            - '\\sigcheck64a.exe'\n            - '\\streams64a.exe'\n            - '\\strings64a.exe'\n            - '\\sync64a.exe'\n            - '\\Sysmon64a.exe'\n            - '\\tcpvcon64a.exe'\n            - '\\tcpview64a.exe'\n            - '\\vmmap64a.exe'\n            - '\\whois64a.exe'\n            - '\\Winobj64a.exe'\n            - '\\ZoomIt64a.exe'\n    filter_valid:\n        - Company:\n              - 'Sysinternals - www.sysinternals.com'\n              - 'Sysinternals'\n        - Product|startswith: 'Sysinternals'\n    filter_empty:\n        - Company: null\n        - Product: null\n    condition: 1 of selection_* and not 1 of filter_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036.005","id":"T1036.005","name":"Match Legitimate Resource Name or Location","page":"techniques/enterprise/T1036.005/"},{"key":"enterprise/T1202","id":"T1202","name":"Indirect Command Execution","page":"techniques/enterprise/T1202/"},{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/7cce6fc8-a07f-4d84-a53e-96e1879843c9.json","kind":"sigma"}