Title:
Suspicious PROCEXP152.sys File Created In TMP
Status:
test
Description:Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder.
This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU.
References:
-https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/
Author: xknow (@xknow_infosec), xorxes (@xor_xes)
Date: 2019-04-08
modified:2026-06-29
Tags:
- -'attack.defense-impairment'
- -'attack.t1685'
Logsource:
- product: windows
- category: file_event
Detection:
selection:
TargetFilename|contains:
'\AppData\Local\Temp\'
TargetFilename|endswith:
'PROCEXP152.sys'
filter:
Image|contains:
-'\procexp64.exe'
-'\procexp64a.exe'
-'\procexp.exe'
-'\procmon64.exe'
-'\procmon64a.exe'
-'\procmon.exe'
condition:
selection and not filter
Falsepositives:
-Other legimate tools using this driver and filename (like Sysinternals). Note - Clever attackers may easily bypass this detection by just renaming the driver filename. Therefore just Medium-level and don't rely on it.
Level:
medium
