LoFP / other legimate tools using this driver and filename (like sysinternals). note - clever attackers may easily bypass this detection by just renaming the driver filename. therefore just medium-level and don't rely on it.

Techniques

• t1562
• t1562.001

Sample rules

Suspicious PROCEXP152.sys File Created In TMP

• source: sigma
• technicques:
  • t1562
  • t1562.001

Description

Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU.

Detection logic

condition: selection and not filter
filter:
  Image|contains:
  - \procexp64.exe
  - \procexp.exe
  - \procmon64.exe
  - \procmon.exe
selection:
  TargetFilename|contains: \AppData\Local\Temp\
  TargetFilename|endswith: PROCEXP152.sys