Sysinternals - CraftedSignal Threat Feed

Suspicious Use of PsLogList for Event Log Discovery and Evasion

hello@craftedsignal.io — Fri, 03 Jul 2026 14:40:17 +0000

This brief details the suspicious use of PsLogList, a legitimate command-line utility from the Sysinternals suite, which is being abused by adversaries for both discovery and defense evasion. PsLogList allows administrators to view, filter, dump, and clear Windows event logs. Attackers exploit this functionality to extract sensitive information, such as admin accounts from security logs, facilitating further account discovery and privilege escalation. Additionally, its capability to clear event logs (-c flag) or export them (-g flag) is utilized to hinder forensic analysis and remove traces of malicious activity. This activity has been observed in campaigns by advanced threat actors, including those targeting major telecommunications companies, highlighting its role in post-compromise reconnaissance and operational security. Detection focuses on command-line arguments indicative of malicious intent rather than legitimate administrative use.

Attack Chain

Initial Access: Adversaries gain initial access to a target system through various means, such as exploiting a public-facing application, phishing, or stolen credentials.
Tool Staging: The PsLogList utility (psloglist.exe or psloglist64.exe) is downloaded and staged on the compromised system, often in a non-standard directory.
Event Log Discovery (Account Enumeration): The adversary executes psloglist.exe with parameters like security, application, or system to dump relevant event logs, specifically searching for local or domain administrator accounts. Example: psloglist security -d 1000
Event Log Export: PsLogList is executed with the -g flag to export event logs to a file (.evt), allowing for offline analysis without triggering host-based detection. Example: psloglist security -g C:\temp\security.evt
Defense Evasion (Log Clearing): The adversary uses psloglist.exe with the -c flag to clear specific event logs, such as the security log, to remove evidence of their presence and actions. Example: psloglist security -c
Information Exploitation: Information gathered from the event logs (e.g., admin accounts, system details) is then used to facilitate lateral movement, privilege escalation, or further targeting within the network.
Impact: Subsequent actions, such as data exfiltration or deploying ransomware, are executed, leveraging the gained privileges and evaded defenses.

Impact

The abuse of PsLogList for event log discovery and defense evasion has a significant impact on an organization's security posture. Successful exploitation allows adversaries to gain a deeper understanding of the victim environment, identify valuable accounts for privilege escalation or lateral movement, and systematically erase their tracks. This directly hampers incident response efforts by removing crucial forensic evidence, making attribution and scope determination extremely difficult. In targeted attacks, such as those against major telcos by Chinese threat actors, this can lead to sustained compromise, intellectual property theft, and disruption of critical infrastructure.

Recommendation

Deploy the Suspicious Use of PsLogList Sigma rule to your SIEM to detect command-line activity associated with this tool.
Ensure process creation logging (e.g., via Sysmon) is enabled and configured to capture full command-line arguments to activate the rules above.
Regularly review administrative use of PsLogList to establish a baseline of legitimate activity and tune detections to reduce false positives.
Investigate any instances where PsLogList is executed with parameters for clearing (-c) or exporting (-g) event logs, especially if originating from non-administrative contexts or user accounts.

Detection of Renamed Sysinternals Tool Usage via Registry EULA Key

hello@craftedsignal.io — Fri, 03 Jul 2026 14:31:43 +0000

Adversaries frequently leverage legitimate system administration tools, such as the Microsoft Sysinternals Suite, to perform malicious activities while attempting to blend in with normal system operations and evade detection. A common tactic involves renaming these tools (e.g., PsExec, ProcDump, Process Explorer) to obfuscate their true identity. This brief outlines a detection mechanism specifically designed to identify instances where non-standard or renamed executables attempt to set the "EulaAccepted" registry key, which is typically written by the legitimate Sysinternals tools upon their first execution. Such activity is highly indicative of defense evasion or post-exploitation stages where attackers use these powerful utilities for lateral movement, privilege escalation, or data collection, often under a masqueraded name to avoid scrutiny. Early detection of such behaviors is critical for disrupting advanced persistent threats operating within a network.

Impact

The successful use of renamed Sysinternals tools can significantly hinder a defender's ability to identify and respond to malicious activity. Attackers utilizing this technique can achieve various objectives, including remote code execution, process dumping (for credential theft), system enumeration, and persistent access without immediately triggering alerts designed for known malicious binaries. This evasion increases dwell time, allows for deeper penetration into the network, and can lead to severe consequences such as data exfiltration, deployment of ransomware, or complete system compromise. Organizations across all sectors are susceptible, as this technique exploits common toolsets rather than specific vulnerabilities in widely deployed applications.

Recommendation

Deploy the provided Sigma rule to your SIEM/EDR platform to detect suspicious "EulaAccepted" registry key modifications by non-Sysinternals executables.
Ensure robust registry event logging is enabled for all Windows endpoints, especially for HKEY_CURRENT_USER\Software\Sysinternals\ paths, to allow the Sigma rule to function effectively.
Conduct regular reviews of alerts generated by this rule to identify potential renamed Sysinternals usage and investigate the associated processes and parent processes.
Implement application whitelisting or strict execution policies to prevent unauthorized executables, particularly those mimicking legitimate tools, from running on critical systems.

Suspicious Execution of Renamed Sysinternals Tools via Registry

hello@craftedsignal.io — Fri, 03 Jul 2026 14:30:39 +0000

This intelligence focuses on the detection of highly suspicious activity involving the Sysinternals Suite, a collection of legitimate, powerful utilities developed by Microsoft. Adversaries frequently leverage these tools for various post-exploitation activities, including process manipulation, system information gathering, and privilege escalation. To circumvent security detections that might flag the execution of standard Sysinternals tool names (e.g., PsExec.exe, ProcDump.exe), attackers often rename these executables. This brief highlights a detection opportunity centered around the creation of the EulaAccepted registry key, which is generated upon the first execution of a Sysinternals tool. When this key is created by an executable that does not match the known original Sysinternals filename, it strongly indicates an attempt at evasion, signaling potential malicious activity on Windows endpoints.

Impact

The successful execution of renamed Sysinternals tools allows adversaries to perform a wide range of actions on compromised Windows systems, often with elevated privileges. This could include dumping credentials, establishing persistence, monitoring system activity, or remotely executing commands, all while attempting to bypass standard security controls. Such evasion tactics enable attackers to remain undetected for longer periods, facilitating further malicious operations like data exfiltration, lateral movement, or the deployment of ransomware. The impact on an organization can range from data breaches and operational disruption to significant financial and reputational damage.

Recommendation

Deploy the Sigma rule "Suspicious Execution Of Renamed Sysinternals Tools - Registry" to your SIEM/EDR to detect this evasive technique.
Ensure Sysmon and Windows Registry logging are comprehensively enabled across all endpoints to capture registry_set events required for this detection.
Investigate all alerts generated by the "Suspicious Execution Of Renamed Sysinternals Tools - Registry" rule immediately to determine the origin and intent of the renamed Sysinternals tool execution.

Sysinternals PsSuspend Suspicious Execution to Impair Defenses

hello@craftedsignal.io — Fri, 03 Jul 2026 14:29:07 +0000

Threat actors are increasingly misusing legitimate system utilities, like Microsoft's Sysinternals PsSuspend, to hinder security defenses. PsSuspend is a powerful tool designed for administrators to pause and resume processes on local or remote systems. However, its capability to suspend any running process, including critical antivirus (AV) and endpoint detection and response (EDR) agents, makes it an attractive target for adversaries seeking to operate undetected. This brief highlights the detection of PsSuspend being executed with command-line arguments targeting security processes such as msmpeng.exe (Microsoft Defender Antivirus service). Such activity indicates an attempt to temporarily disable or bypass security controls, allowing subsequent malicious activity to proceed without interference. While the exact campaigns are not specified in the source, this technique is broadly adopted by various sophisticated threat groups for defense evasion.

Attack Chain

[Insufficient information in the provided source to construct a detailed 6-8 step attack chain covering initial access through impact. The source describes a single defense impairment action rather than a full campaign lifecycle.]

Impact

Successful execution of PsSuspend against security processes can lead to a critical blind spot in an organization's defense posture. When AV/EDR agents are suspended, they cease to monitor, detect, and prevent malicious activities, effectively disarming endpoint protection. This allows threat actors to perform actions such as executing malware, establishing persistence, exfiltrating data, or deploying ransomware without being detected. The immediate consequence is a loss of visibility and control, significantly increasing the risk of a successful breach and subsequent data compromise or system disruption.

Recommendation

Deploy the provided Sigma rule "Sysinternals PsSuspend Suspicious Execution" to your SIEM and tune for your environment to detect attempts to suspend security products.
Ensure process creation logging, especially for command-line arguments, is enabled on all Windows endpoints to support the detection rules.
Restrict the execution of unauthorized or unapproved system utilities, including Sysinternals tools, on critical endpoints.
Implement strong access controls and principle of least privilege to prevent unauthorized users or processes from running tools like PsSuspend.

Abuse of Microsoft Sysinternals PsSuspend Utility

hello@craftedsignal.io — Fri, 03 Jul 2026 14:28:11 +0000

The Microsoft Sysinternals PsSuspend utility, a legitimate command-line tool, allows administrators to suspend and resume processes on local or remote Windows systems. While designed for troubleshooting and system management, its capabilities can be abused by threat actors to halt critical security software, database services, or other essential applications, thereby disrupting operations or facilitating malicious activities like data exfiltration or ransomware deployment. This brief focuses on the detection of PsSuspend's execution as an indicator of potential abuse. The source material does not detail a specific attack campaign or actor, but highlights the tool's potential for misuse within a broader attack chain to achieve objectives like evasion, persistence, or denial of service.

Impact

The successful abuse of PsSuspend can lead to significant operational disruption and security breaches. By suspending essential processes, attackers can disable endpoint detection and response (EDR) agents, anti-virus software, and other security controls, allowing them to operate undetected. It can also be used to pause critical business applications, leading to denial of service, data inconsistencies, or creating windows of opportunity for data exfiltration before legitimate processes can react. The impact could range from temporary service outages to complete system compromise if security tools are effectively bypassed.

Recommendation

Enable process creation logging (e.g., via Sysmon) on all Windows endpoints to ensure the process_creation log source is available.
Deploy the "Sysinternals PsSuspend Execution" Sigma rule to your SIEM for detecting PsSuspend usage.
Monitor for process suspensions that are not part of approved administrative tasks.
Implement application whitelisting or strict controls over the execution of Sysinternals tools on sensitive systems.

Detection of Sysinternals PsService Execution

hello@craftedsignal.io — Fri, 03 Jul 2026 14:27:18 +0000

Sysinternals PsService is a command-line utility for Windows systems that allows users, typically administrators, to view and control services. While a legitimate tool for system management, it can be leveraged by malicious actors post-compromise for various nefarious activities. Threat actors can use PsService to enumerate running services for discovery (TA0007), stop critical services to disrupt operations, start malicious services for persistence (TA0003), or modify service configurations to achieve privilege escalation (TA0004). The execution of this tool, especially from unusual directories or by non-administrative accounts, is a strong indicator of potential malicious activity. Defenders should be aware of its legitimate uses versus its potential for abuse in the hands of an attacker to identify anomalous behavior.

Attack Chain

This detection brief focuses on the execution of a specific tool, Sysinternals PsService, which can be used at various stages of an attack. The source material does not provide a full, observed attack chain from initial access to impact. Therefore, this section is omitted as per quality requirements.

Impact

The abuse of Sysinternals PsService can lead to significant impact depending on how an attacker utilizes it. If used for reconnaissance, it facilitates further lateral movement or targeting of critical systems. If used to stop or disable essential services, it can cause severe disruption to business operations, leading to downtime and data loss. Modifying services can grant attackers elevated privileges, allowing them to install persistent backdoors or execute arbitrary code with SYSTEM rights, compromising the integrity and confidentiality of the affected system and potentially the entire network.

Recommendation

Deploy the provided "Sysinternals PsService Execution" Sigma rule to your SIEM solution to detect instances of PsService.exe execution.
Enable process creation logging, such as via Sysmon, to ensure the necessary Image and OriginalFileName fields are captured for the Sigma rule.
Investigate alerts from the "Sysinternals PsService Execution" rule, paying close attention to the parent process, command-line arguments, and the user context of the execution.
Review legitimate uses of PsService within your environment and consider whitelisting known legitimate execution paths or users if false positives occur, as highlighted in the rule's falsepositives field.

Procdump Execution Detection

hello@craftedsignal.io — Fri, 03 Jul 2026 14:25:53 +0000

Procdump is a command-line utility from Microsoft's Sysinternals suite, designed primarily for troubleshooting application crashes by generating memory dumps of processes. While a legitimate tool used by developers and system administrators for debugging, it is also widely co-opted by malicious actors. Attackers leverage Procdump to dump the memory of sensitive processes, most notably Local Security Authority Subsystem Service (LSASS), to extract credentials such as NTLM hashes or plaintext passwords. This technique allows adversaries to bypass traditional endpoint security measures that might block direct access to LSASS or other credential-storage mechanisms. Its execution often indicates an attacker has already gained a foothold and is attempting to escalate privileges or move laterally within a compromised Windows environment.

Impact

The successful abuse of Procdump can lead to significant compromise. By extracting credentials from processes like LSASS, attackers gain access to legitimate user and administrative account credentials. This enables them to perform lateral movement, access restricted resources, escalate privileges, and maintain persistence within an organization's network. The primary impact is unauthorized access to sensitive data and systems, potentially leading to data exfiltration, system destruction, or deployment of further malicious payloads like ransomware. The ease with which Procdump can be used makes it a popular choice for credential dumping in targeted attacks.

Recommendation

Deploy the Sigma rule "Detect Procdump Execution" to your SIEM to alert on the execution of the procdump.exe binary.
Investigate all instances of procdump.exe, procdump64.exe, or procdump64a.exe execution, especially if originating from non-standard directories or executed by non-administrative accounts.
Enable Sysmon process creation logging to ensure process_creation events for procdump.exe are collected and available for analysis by the provided Sigma rule.
Review legitimate use cases for Procdump within your environment and create baselines or whitelisting rules to reduce false positives for authorized debugging activities.

Permission Check Via Accesschk.EXE

hello@craftedsignal.io — Fri, 03 Jul 2026 14:25:04 +0000

Adversaries are leveraging the legitimate Microsoft Sysinternals utility Accesschk.exe to perform reconnaissance and permission checking on compromised Windows systems. This tool, originally designed for system administrators to audit permissions, is a favored binary for threat actors due to its native capabilities and often being pre-trusted by security solutions. Its abuse enables attackers to quickly identify misconfigurations, weak permissions, or unquoted service paths on files, directories, registry keys, services, and processes. This information is crucial for planning subsequent privilege escalation techniques, allowing an attacker to move from a low-privileged foothold to administrative or system-level access, thereby advancing their objectives such as persistence, lateral movement, or data exfiltration.

Attack Chain

Initial Compromise: An attacker gains initial access to a target Windows system, typically through methods like phishing, exploiting a vulnerable service, or compromising credentials.
Tool Staging: The Accesschk.exe utility (or its 64-bit variants like accesschk64.exe) is transferred to the compromised system, often via existing C2 channels, PowerShell, or embedded within a larger malicious payload.
Permission Discovery: The attacker executes Accesschk.exe from a command prompt or script using specific flags such as uwcqv (users with write access to services), kwsu (kernel objects, services, users), or uwdqs (users with write access to directories/shares) to enumerate detailed permissions across various system objects.
Output Analysis: The command output is parsed by the attacker to identify specific misconfigurations or weak access control lists (ACLs) that could be exploited. This might include writable service binaries, DLL hijack paths, or modifiable registry keys.
Identify Escalation Paths: Based on the gathered permission data, the attacker pinpoints viable privilege escalation vectors, such as services configured to run with SYSTEM privileges but having a writable binary path, or registry keys that control critical system functions and are modifiable by low-privileged users.
Exploitation Planning: The attacker formulates a strategy to exploit the identified weaknesses, which could involve replacing legitimate binaries with malicious ones, modifying service parameters, or injecting code into processes to achieve higher privileges.
Privilege Escalation: The attacker executes their chosen method to elevate privileges, often resulting in gaining administrator or SYSTEM-level access on the compromised host.
Post-Escalation Actions: With elevated privileges, the attacker can proceed with further malicious activities, including deploying additional malware, establishing persistence, moving laterally within the network, or exfiltrating sensitive data.

Impact

Successful abuse of Accesschk.exe as part of a privilege escalation chain can lead to full system compromise, allowing attackers to gain complete control over the affected Windows machine. This enables them to bypass security controls, install rootkits, steal credentials, deploy ransomware, or exfiltrate critical intellectual property and sensitive data. While Accesschk.exe itself doesn't cause direct damage, its role in uncovering vulnerabilities can directly lead to significant security breaches, financial loss, reputational damage, and operational disruption for affected organizations across all sectors.

Recommendation

Deploy the Sigma rule Permission Check Via Accesschk.EXE to your SIEM and tune for your environment to detect suspicious usage of this utility.
Ensure Sysmon process creation logging is enabled for all Windows endpoints to capture Image and CommandLine details necessary for the rule Permission Check Via Accesschk.EXE.
Regularly audit permissions on critical system resources and services to identify and remediate misconfigurations that Accesschk.exe could reveal to an attacker.

Detecting Renamed ProcDump Execution for Evasion

hello@craftedsignal.io — Fri, 03 Jul 2026 14:23:37 +0000

This intelligence brief addresses the technique of executing renamed Sysinternals ProcDump binaries, a common evasion tactic used by sophisticated threat actors. ProcDump, a legitimate utility from Microsoft Sysinternals, is designed to monitor an application for CPU spikes and generate crash dumps. However, adversaries frequently abuse it to dump the Local Security Authority Subsystem Service (LSASS) process memory, which often contains sensitive credential material. By renaming the procdump.exe or procdump64.exe binary (e.g., to dump.exe or service.exe), attackers aim to bypass static detections based on file names or hash values, making their activities harder to spot for security defenders. This tactic significantly raises the risk of credential theft, enabling lateral movement and privilege escalation within compromised environments.

Attack Chain

Initial Access: A threat actor gains initial access to a Windows system, often via phishing, exploited vulnerabilities, or RDP brute-forcing.
Tool Staging: The attacker uploads a copy of ProcDump (or another legitimate tool like comsvcs.dll for rundll32.exe memory dumping) to the compromised system.
Renaming for Evasion: The ProcDump executable is renamed to a seemingly innocuous name (e.g., dump.exe, explorer.exe, svchost.exe, or other names not in the default Sysinternals installation path) to avoid detection by traditional endpoint security solutions that might whitelist or specifically monitor procdump.exe.
Credential Dumping: The renamed ProcDump executable is launched via the command line to target the lsass.exe process and create a memory dump. Typical command-line arguments include -ma for a full memory dump, or -mp for mini plus. The accepteula flag is often used to suppress the license agreement prompt.
Exfiltration: The generated LSASS memory dump file, which may contain NTLM hashes, Kerberos tickets, or clear-text passwords, is compressed or encrypted and exfiltrated from the network to attacker-controlled infrastructure.
Lateral Movement/Privilege Escalation: The stolen credentials are used for lateral movement to other systems, accessing sensitive resources, or escalating privileges within the compromised environment.

Impact

Successful exploitation of this technique can lead to severe organizational impact, including widespread credential theft and unauthorized access across the enterprise network. Compromised credentials allow threat actors to escalate privileges, move laterally to critical systems, bypass multi-factor authentication (if not properly configured), and gain persistence. This often precedes data exfiltration, deployment of ransomware, or other destructive activities, resulting in significant financial losses, operational disruption, and reputational damage. The pervasive nature of credential abuse makes it a high-priority threat for detection engineers.

Recommendation

Deploy the provided Sigma rule "Detecting Renamed ProcDump Execution" to your SIEM to identify suspicious ProcDump activity.
Ensure Sysmon process-creation logging is enabled to provide the necessary OriginalFileName, Image, and CommandLine fields for the detection rule.
Investigate any alerts generated by the rule, especially those involving OriginalFileName: 'procdump' where Image does not end in \procdump.exe, \procdump64.exe, or \procdump64a.exe.
Implement strong access controls and principle of least privilege to limit the ability of non-administrative accounts to execute or rename tools in sensitive directories.
Regularly review and harden endpoint security configurations to block or alert on the execution of non-standard binaries in unexpected locations.