Unusual use of a 'SysInternals' tool

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	Obfuscated Files or Information (T1027)
Severity	Informational

Description

An attacker may be trying to avoid detection by using an obfuscated copy of SysInternals tools.

Attacker's Goals

Attackers may leverage SysInternals tools for lateral movement, credential access, or to delete recovery backups to cause impact.

Investigative actions

• Check if the file is familiar to the user, if not, investigate further the source of it.

Variations

Unusual use of a 'SysInternals' tool by a process with an invalid or non-standard signature

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	Obfuscated Files or Information (T1027)
Severity	High

Description

An attacker may be trying to avoid detection by using an obfuscated copy of SysInternals tools.

Attacker's Goals

Attackers may leverage SysInternals tools for lateral movement, credential access, or to delete recovery backups to cause impact.

Investigative actions

• Check if the file is familiar to the user, if not, investigate further the source of it.

Unusual use of a 'SysInternals' tool that can be used for offensive operations

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	Obfuscated Files or Information (T1027)
Severity	High

Description

An attacker may be trying to avoid detection by using an obfuscated copy of SysInternals tools.

Attacker's Goals

Attackers may leverage SysInternals tools for lateral movement, credential access, or to delete recovery backups to cause impact.

Investigative actions

• Check if the file is familiar to the user, if not, investigate further the source of it.

A registry key related to SysInternals was modified by a known registry editor

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	Obfuscated Files or Information (T1027)
Severity	Informational

Description

A registry key related to SysInternals was modified by a known registry editor to circumvent a EULA prompt.

Attacker's Goals

Attackers may leverage SysInternals tools for lateral movement, credential access, or to delete recovery backups to cause impact.

Investigative actions

• Check if the file is familiar to the user, if not, investigate further the source of it.