Hayabusa medium test sigma

Process Monitor Driver Creation By Non-Sysinternals Binary

Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.

View Source

Detection Logic

{
  "file_event": {
    "EventID": 11,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "TargetFilename
| contains": "\\procmon",
    "TargetFilename
| endswith": ".sys"
  },
  "filter_main_process_explorer": {
    "Image
| endswith": [
      "\\procmon.exe",
      "\\procmon64.exe",
      "\\procmon64a.exe"
    ]
  },
  "condition": "file_event and (selection and not 1 of filter_main_*)"
}

False Positives

  • ⚠ Some false positives may occur with legitimate renamed process monitor binaries

Field Validations

Loading…

Comments (0)

Loading comments...