{"id":"de46c52b-0bf8-4936-a327-aace94f94ac6","title":"Process Explorer Driver Creation By Non-Sysinternals Binary","description":"Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself.\nHack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.\n","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2023-05-05","modified":"","tags":["attack.persistence","attack.privilege-escalation","attack.t1068"],"technique_ids":["T1068"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Some false positives may occur with legitimate renamed process explorer binaries"],"references":["https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer","https://github.com/Yaxser/Backstab","https://www.elastic.co/security-labs/stopping-vulnerable-driver-attacks","https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/"],"source_path":"rules/windows/file/file_event/file_event_win_sysinternals_procexp_driver_susp_creation.yml","source_sha256":"a22fd85e858b036f47cbb7699839ac65bb6f6a4536118d2c67c92b316fd0124a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_sysinternals_procexp_driver_susp_creation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Process Explorer Driver Creation By Non-Sysinternals Binary\nid: de46c52b-0bf8-4936-a327-aace94f94ac6\nstatus: test\ndescription: |\n    Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself.\n    Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.\nreferences:\n    - https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer\n    - https://github.com/Yaxser/Backstab\n    - https://www.elastic.co/security-labs/stopping-vulnerable-driver-attacks\n    - https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/\nauthor: Florian Roth (Nextron Systems)\ndate: 2023-05-05\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1068\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        TargetFilename|contains: '\\PROCEXP'\n        TargetFilename|endswith: '.sys'\n    filter_main_process_explorer:\n        Image|endswith:\n            - '\\procexp.exe'\n            - '\\procexp64.exe'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Some false positives may occur with legitimate renamed process explorer binaries\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1068","id":"T1068","name":"Exploitation for Privilege Escalation","page":"techniques/enterprise/T1068/"}],"data_path":"data/detection-rules/de46c52b-0bf8-4936-a327-aace94f94ac6.json","kind":"sigma"}