Analytics BIOC Informational
✕

Unusual use of a 'SysInternals' tool

An attacker may be trying to avoid detection by using an obfuscated copy of SysInternals tools.

Module:
Platform Analytics
Data source:
XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Obfuscated Files or Information (T1027)
Attacker's goals:

Attackers may leverage SysInternals tools for lateral movement, credential access, or to delete recovery backups to cause impact.

Investigative actions:

Check if the file is familiar to the user, if not, investigate further the source of it.

Test period:
N/A (single event)
Deduplication:
1 Day
3 variations:
  • Unusual use of a 'SysInternals' tool by a process with an invalid or non-standard signature High (parent: Informational)
  • Unusual use of a 'SysInternals' tool that can be used for offensive operations High (parent: Informational)
  • A registry key related to SysInternals was modified by a known registry editor Informational