Suspicious PROCEXP152.sys File Created In TMP
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "File Created or Modified" AND ((FILENAME contains "\AppData\Local\Temp" OR OBJECTNAME contains "\AppData\Local\Temp") AND (FILENAME endswith "PROCEXP152.sys" OR OBJECTNAME endswith "PROCEXP152.sys")) AND PROCESSNAME notcontains "\procexp64.exe,\procexp.exe,\procmon64.exe,\procmon.exe" select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.OBJECTNAME,Action1.FILENAME,Action1.PROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
xknow (@xknow_infosec), xorxes (@xor_xes)
