Process Explorer Driver Creation By Non-Sysinternals Binary

Severity: high
Author: Florian Roth (Nextron Systems)
Source: upstream

Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself. Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1068` Exploitation for Privilege Escalation

Event coverage

Provider	Event ID	Title
Sysmon	11	FileCreate

Stages and Predicates

Stage 1: `selection`

TargetFilename|endswith: .sys
TargetFilename|contains: '\PROCEXP'

Stage 2: `not 1 of filter_main_process_explorer`

or:
Image|endswith: '\procexp.exe'
Image|endswith: '\procexp64.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Image`	ends_with	`\procexp.exe` corpus 6 (sigma 6) `\procexp64.exe` corpus 6 (sigma 6)
`TargetFilename`	ends_with	`.sys` corpus 6 (sigma 6)
`TargetFilename`	match	`\PROCEXP`