Attack Chain

1. Initial Compromise: An adversary gains initial access to a Windows system through an unspecified mechanism, such as exploiting a vulnerability or via a phishing attack.
2. Execution: Malware or hack tools are executed on the compromised endpoint, initiating the malicious activity.
3. Payload Dropping: The malicious process (not procexp.exe or its variants) drops a legitimate Sysinternals Process Explorer driver file (e.g., PROCEXP64.sys) to a temporary location on the disk.
4. Service Creation: The malware programmatically creates a new Windows service, configured to load and execute the dropped PROCEXP*.sys driver.
5. Privilege Escalation: The newly created service is started, leveraging the signed Process Explorer driver to achieve system-level privileges, allowing the attacker to bypass user access controls and potentially EDR solutions.
6. Post-Exploitation & Cleanup: After achieving the desired objective (e.g., disabling security software, system modifications), the malware removes the dropped driver file and may delete the associated service to cover its tracks and evade forensic analysis.

Impact

The successful exploitation of this technique grants attackers system-level privileges, enabling them to completely compromise the affected Windows endpoint. This can lead to the termination or disabling of security software (such as EDR agents), exfiltration of sensitive data, deployment of ransomware, or establishment of persistent access. The impact can extend to full network compromise if the elevated privileges are used to pivot to other systems or compromise domain controllers. Specific instances have been observed where this technique contributed to EDR bypasses, allowing malware like Aukill to operate undetected.

Recommendation

• Deploy the Sigma rule 'Process Explorer Driver Creation By Non-Sysinternals Binary' to your SIEM and tune for your environment.
• Enable file_event logging (e.g., Sysmon Event ID 11 for FileCreate) on all Windows endpoints to ensure the detection rule has the necessary telemetry.
• Implement application whitelisting solutions to prevent unauthorized executables from running on endpoints.

Attack Chain

A full multi-stage attack chain is not described in the source material, which focuses on a specific defense evasion technique rather than an end-to-end campaign. The technique primarily involves an attacker having already achieved initial access and aiming to maintain persistence and evade detection.

Impact

Successful deployment of the PROCEXP152.sys driver by malicious tools for defense evasion can lead to significant compromise of system visibility. By bypassing Sysmon and Windows Event Logging, attackers can execute commands, establish persistence, exfiltrate data, or deploy additional malware without leaving observable traces in standard security logs. This impairment makes it exceedingly difficult for security operations centers to detect and respond to ongoing intrusions, leading to prolonged dwell times and potentially widespread damage. While no specific victim counts are mentioned, this technique is broadly applicable to Windows environments, affecting organizations of all sectors reliant on endpoint detection for security.

Recommendation

• Deploy the Suspicious PROCEXP152.sys File Created In TMP Sigma rule to your SIEM/EDR to detect the creation of this driver in suspicious locations.
• Ensure File Creation logging (Event ID 11) is enabled for Sysmon or similar file system monitoring to capture the artifact referenced in the rule.
• Investigate any alerts generated by the Suspicious PROCEXP152.sys File Created In TMP rule, focusing on the parent process responsible for creating the .sys file.
• Review the referenced blog post (https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/) for further context on defense evasion techniques involving drivers.