Query: alert when Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by S
Matching passage: Sigma rule: Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by S. Logsource: windows / file_event. Rule: title: Suspicious PROCEXP152.sys File Created In TMP id: 3da70954-0f2c-4103-adff-b7440368f50e status: test description: 'Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU. ' references: - https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/ author: xknow (@xknow_infosec), xorxes (@xor_xes) date: 2019-04-08 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \AppData\Local\Temp\ TargetFilename|endswith: PROCEXP152.sys filter: Image|contains: - \procexp64.exe - \procexp64a.exe - \procexp.exe - \procmon64.exe - \procmon64a.exe - \procmon.exe condition: selection and not filter falsepositives: - Other legimate tools using this driver and filename (like Sysinternals). Note - Clever attackers may easily bypass this detection by just renaming the driver filename. Therefore just Medium-level and don't rely on it. level: medium
Near-miss passage: Sigma rule: Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered. Logsource: windows / process_creation. Rule: title: DSInternals Suspicious PowerShell Cmdlets id: 43d91656-a9b2-4541-b7e2-6a9bd3a13f4e related: - id: 846c7a87-8e14-4569-9d49-ecfd4276a01c type: similar status: test description: 'Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation. ' references: - https://github.com/MichaelGrafnetter/DSInternals/blob/39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4/Src/DSInternals.PowerShell/DSInternals.psd1 author: Nasreddine Bencherchali (Nextron Systems), Nounou Mbeiri date: 2024-06-26 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - Add-ADDBSidHistory - Add-ADNgcKey - Add-ADReplNgcKey - ConvertFrom-ADManagedPasswordBlob - ConvertFrom-GPPrefPassword - ConvertFrom-ManagedPasswordBlob - ConvertFrom-UnattendXmlPassword - ConvertFrom-UnicodePassword - ConvertTo-AADHash - ConvertTo-GPPrefPassword - ConvertTo-KerberosKey - ConvertTo-LMHash - ConvertTo-MsoPasswordHash - ConvertTo-NTHash - ConvertTo-OrgIdHash - ConvertTo-UnicodePassword - Disable-ADDBAccount - Enable-ADDBAccount - Get-ADDBAccount - Get-ADDBBackupKey - Get-ADDBDomainController - Get-ADDBGroupManagedServiceAccount - Get-ADDBKdsRootKey - Get-ADDBSchemaAttribute - Get-ADDBServiceAccount - Get-ADDefaultPasswordPolicy - Get-ADKeyCredential - Get-ADPasswordPolicy - Get-ADReplAccount - Get-ADReplBackupKey - Get-ADReplicationAccount - Get-ADSIAccount - Get-AzureADUserEx - Get-BootKey - Get-KeyCredential - Get-LsaBackupKey - Get-LsaPolicy - Get-SamPasswordPolicy - Get-SysKey - Get-SystemKey - New-ADDBRestoreFromMediaScript - New-ADKeyCredential - New-ADNgcKey - New-NTHashSet - Remove-ADDBObject - Save-DPAPIBlob - Set-ADAccountPasswordHash - Set-ADDBAccountPassword - Set-ADDBBootKey - Set-ADDBDomainController - Set-ADDBPrimaryGroup - Set-ADDBSysKey - Set-AzureADUserEx - Set-LsaPolicy - Set-SamAccountPasswordHash - Set-WinUserPasswordHash - Test-ADDBPasswordQuality - Test-ADPasswordQuality - Test-ADReplPasswordQuality - Test-PasswordQuality - Unlock-ADDBAccount - Write-ADNgcKey - Write-ADReplNgcKey condition: se