LoFP / some false positives may occur with legitimate renamed process explorer binaries

Techniques

• t1068

Sample rules

Process Explorer Driver Creation By Non-Sysinternals Binary

• source: sigma
• technicques:
  • t1068

Description

Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself. Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.

Detection logic

condition: selection and not 1 of filter_main_*
filter_main_process_explorer:
  Image|endswith:
  - \procexp.exe
  - \procexp64.exe
selection:
  TargetFilename|contains: \PROCEXP
  TargetFilename|endswith: .sys