Renamed SysInternals DebugView Execution

Title: Renamed SysInternals DebugView Execution
Status: test
Description:Detects suspicious renamed SysInternals DebugView execution
References:
  -https://www.epicturla.com/blog/sysinturla
Author: Florian Roth (Nextron Systems)
Date: 2020-05-28
modified:2023-02-14
Tags:

• -'attack.resource-development'
• -'attack.t1588.002'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Product: 'Sysinternals DebugView'
  filter:
    OriginalFileName: 'Dbgview.exe'
    Image|endswith: '\Dbgview.exe'
  condition:selection and not filter
Falsepositives:
  -Unknown
Level: high