frack113
175 lines
5.1 KiB
YAML
175 lines
5.1 KiB
YAML
title: False Sysinternals Suite Tools
|
|
id: 7cce6fc8-a07f-4d84-a53e-96e1879843c9
|
|
status: experimental
|
|
description: Rename as a legitim Sysinternals Suite tools to evade detection
|
|
references:
|
|
- https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite
|
|
author: frack113
|
|
date: 2021/12/20
|
|
logsource:
|
|
category: process_creation
|
|
product: windows
|
|
detection:
|
|
selection_exe:
|
|
Image|endswith:
|
|
- '\accesschk.exe'
|
|
- '\accesschk64.exe'
|
|
- '\AccessEnum.exe'
|
|
- '\ADExplorer.exe'
|
|
- '\ADExplorer64.exe'
|
|
- '\ADInsight.exe'
|
|
- '\ADInsight64.exe'
|
|
- '\adrestore.exe'
|
|
- '\adrestore64.exe'
|
|
- '\Autologon.exe'
|
|
- '\Autologon64.exe'
|
|
- '\Autoruns.exe'
|
|
- '\Autoruns64.exe'
|
|
- '\autorunsc.exe'
|
|
- '\autorunsc64.exe'
|
|
- '\Bginfo.exe'
|
|
- '\Bginfo64.exe'
|
|
- '\Cacheset.exe'
|
|
- '\Cacheset64.exe'
|
|
- '\Clockres.exe'
|
|
- '\Clockres64.exe'
|
|
- '\Contig.exe'
|
|
- '\Contig64.exe'
|
|
- '\Coreinfo.exe'
|
|
- '\Coreinfo64.exe'
|
|
- '\CPUSTRES.EXE'
|
|
- '\CPUSTRES64.EXE'
|
|
- '\ctrl2cap.exe'
|
|
- '\Dbgview.exe'
|
|
- '\dbgview64.exe'
|
|
- '\Desktops.exe'
|
|
- '\Desktops64.exe'
|
|
- '\disk2vhd.exe'
|
|
- '\disk2vhd64.exe'
|
|
- '\diskext.exe'
|
|
- '\diskext64.exe'
|
|
- '\Diskmon.exe'
|
|
- '\Diskmon64.exe'
|
|
- '\DiskView.exe'
|
|
- '\DiskView64.exe'
|
|
- '\du.exe'
|
|
- '\du64.exe'
|
|
- '\efsdump.exe'
|
|
- '\FindLinks.exe'
|
|
- '\FindLinks64.exe'
|
|
- '\handle.exe'
|
|
- '\handle64.exe'
|
|
- '\hex2dec.exe'
|
|
- '\hex2dec64.exe'
|
|
- '\junction.exe'
|
|
- '\junction64.exe'
|
|
- '\ldmdump.exe'
|
|
- '\listdlls.exe'
|
|
- '\listdlls64.exe'
|
|
- '\livekd.exe'
|
|
- '\livekd64.exe'
|
|
- '\loadOrd.exe'
|
|
- '\loadOrd64.exe'
|
|
- '\loadOrdC.exe'
|
|
- '\loadOrdC64.exe'
|
|
- '\logonsessions.exe'
|
|
- '\logonsessions64.exe'
|
|
- '\movefile.exe'
|
|
- '\movefile64.exe'
|
|
- '\notmyfault.exe'
|
|
- '\notmyfault64.exe'
|
|
- '\notmyfaultc.exe'
|
|
- '\notmyfaultc64.exe'
|
|
- '\ntfsinfo.exe'
|
|
- '\ntfsinfo64.exe'
|
|
- '\pendmoves.exe'
|
|
- '\pendmoves64.exe'
|
|
- '\pipelist.exe'
|
|
- '\pipelist64.exe'
|
|
- '\portmon.exe'
|
|
- '\procdump.exe'
|
|
- '\procdump64.exe'
|
|
- '\procexp.exe'
|
|
- '\procexp64.exe'
|
|
- '\Procmon.exe'
|
|
- '\Procmon64.exe'
|
|
- '\psExec.exe'
|
|
- '\psExec64.exe'
|
|
- '\psfile.exe'
|
|
- '\psfile64.exe'
|
|
- '\psGetsid.exe'
|
|
- '\psGetsid64.exe'
|
|
- '\psInfo.exe'
|
|
- '\psInfo64.exe'
|
|
- '\pskill.exe'
|
|
- '\pskill64.exe'
|
|
- '\pslist.exe'
|
|
- '\pslist64.exe'
|
|
- '\psLoggedon.exe'
|
|
- '\psLoggedon64.exe'
|
|
- '\psloglist.exe'
|
|
- '\psloglist64.exe'
|
|
- '\pspasswd.exe'
|
|
- '\pspasswd64.exe'
|
|
- '\psping.exe'
|
|
- '\psping64.exe'
|
|
- '\psService.exe'
|
|
- '\psService64.exe'
|
|
- '\psshutdown.exe'
|
|
- '\psshutdown64.exe'
|
|
- '\pssuspend.exe'
|
|
- '\pssuspend64.exe'
|
|
- '\RAMMap.exe'
|
|
- '\RDCMan.exe'
|
|
- '\RegDelNull.exe'
|
|
- '\RegDelNull64.exe'
|
|
- '\regjump.exe'
|
|
- '\ru.exe'
|
|
- '\ru64.exe'
|
|
- '\sdelete.exe'
|
|
- '\sdelete64.exe'
|
|
- '\ShareEnum.exe'
|
|
- '\ShareEnum64.exe'
|
|
- '\shellRunas.exe'
|
|
- '\sigcheck.exe'
|
|
- '\sigcheck64.exe'
|
|
- '\streams.exe'
|
|
- '\streams64.exe'
|
|
- '\strings.exe'
|
|
- '\strings64.exe'
|
|
- '\sync.exe'
|
|
- '\sync64.exe'
|
|
- '\Sysmon.exe'
|
|
- '\Sysmon64.exe'
|
|
- '\tcpvcon.exe'
|
|
- '\tcpvcon64.exe'
|
|
- '\tcpview.exe'
|
|
- '\tcpview64.exe'
|
|
- '\Testlimit.exe'
|
|
- '\Testlimit64.exe'
|
|
- '\vmmap.exe'
|
|
- '\vmmap64.exe'
|
|
- '\Volumeid.exe'
|
|
- '\Volumeid64.exe'
|
|
- '\whois.exe'
|
|
- '\whois64.exe'
|
|
- '\Winobj.exe'
|
|
- '\Winobj64.exe'
|
|
- '\ZoomIt.exe'
|
|
- '\ZoomIt64.exe'
|
|
filter_valid:
|
|
Company:
|
|
- 'Sysinternals - www.sysinternals.com'
|
|
- 'Sysinternals'
|
|
filter_empty:
|
|
Company: null
|
|
condition: selection_exe and not 1 of filter*
|
|
falsepositives:
|
|
- Unknown
|
|
level: medium
|
|
tags:
|
|
- attack.execution
|
|
- attack.defense_evasion
|
|
- attack.t1218
|
|
- attack.t1202
|