Query: write Sigma for Detects binaries that use the same name as legitimate sysinternals tools to evade detection. This rule looks for the exe
Matching passage: Sigma rule: Detects binaries that use the same name as legitimate sysinternals tools to evade detection. This rule looks for the exe. Logsource: windows / process_creation. Rule: title: Potential Binary Impersonating Sysinternals Tools id: 7cce6fc8-a07f-4d84-a53e-96e1879843c9 status: test description: 'Detects binaries that use the same name as legitimate sysinternals tools to evade detection. This rule looks for the execution of binaries that are named similarly to Sysinternals tools. Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2021-12-20 modified: 2025-04-12 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 - attack.t1036.005 logsource: category: process_creation product: windows detection: selection_exe: Image|endswith: - \accesschk.exe - \accesschk64.exe - \AccessEnum.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADInsight.exe - \ADInsight64.exe - \adrestore.exe - \adrestore64.exe - \Autologon.exe - \Autologon64.exe - \Autoruns.exe - \Autoruns64.exe - \autorunsc.exe - \autorunsc64.exe - \Bginfo.exe - \Bginfo64.exe - \Cacheset.exe - \Cacheset64.exe - \Clockres.exe - \Clockres64.exe - \Contig.exe - \Contig64.exe - \Coreinfo.exe - \Coreinfo64.exe - \CPUSTRES.EXE - \CPUSTRES64.EXE - \ctrl2cap.exe - \Dbgview.exe - \dbgview64.exe - \Desktops.exe - \Desktops64.exe - \disk2vhd.exe - \disk2vhd64.exe - \diskext.exe - \diskext64.exe - \Diskmon.exe - \Diskmon64.exe - \DiskView.exe - \DiskView64.exe - \du.exe - \du64.exe - \efsdump.exe - \FindLinks.exe - \FindLinks64.exe - \handle.exe - \handle64.exe - \hex2dec.exe - \hex2dec64.exe - \junction.exe - \junction64.exe - \ldmdump.exe - \listdlls.exe - \listdlls64.exe - \livekd.exe - \livekd64.exe - \loadOrd.exe - \loadOrd64.exe - \loadOrdC.exe - \loadOrdC64.exe - \logonsessions.exe - \logonsessions64.exe - \movefile.exe - \movefile64.exe - \notmyfault.exe - \notmyfault64.exe - \notmyfaultc.exe - \notmyfaultc64.exe - \ntfsinfo.exe - \ntfsinfo64.exe - \pendmoves.exe - \pendmoves64.exe - \pipelist.exe - \pipelist64.exe - \portmon.exe - \procdump.exe - \procdump64.exe - \procexp.exe - \procexp64.exe - \Procmon.exe - \Procmon64.exe - \psExec.exe - \psExec64.exe - \psfile.exe - \psfile64.exe - \psGetsid.exe - \psGetsid64.exe - \psInfo.exe - \psInfo64.exe - \pskill.exe - \pskill64.exe - \pslist.exe - \pslist64.exe - \psLoggedon.exe - \psLoggedon64.exe - \psloglist.exe - \psloglist64.exe - \pspasswd.exe - \pspasswd64.exe - \psping.exe - \psping64.exe - \psService.exe - \p
Near-miss passage: Sigma rule: Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use val. Logsource: windows / process_creation. Rule: title: New Remote Desktop Connection Initiated Via Mstsc.EXE id: 954f0af7-62dd-418f-b3df-a84bc2c7a774 status: test description: 'Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#t1021001---remote-desktop-protocol - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc author: frack113 date: 2022-01-07 modified: 2024-06-04 tags: - attack.lateral-movement - attack.t1021.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mstsc.exe - OriginalFileName: mstsc.exe selection_cli: CommandLine|contains|windash: ' /v:' filter_optional_wsl: ParentImage: C:\Windows\System32\lxss\wslhost.exe CommandLine|contains: C:\ProgramData\Microsoft\WSL\wslg.rdp condition: all of selection_* and not 1 of filter_optional_* falsepositives: - WSL (Windows Sub System For Linux) level: medium