Process Monitor Driver Creation By Non-Sysinternals Binary

Title: Process Monitor Driver Creation By Non-Sysinternals Binary
Status: test
Description:Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.
References:
  -Internal Research
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-05
modified:2026-06-29
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.t1068'

Logsource:

• product: windows
• category: file_event

Detection:
  selection:
    TargetFilename|contains: '\procmon'
    TargetFilename|endswith: '.sys'
  filter_main_process_explorer:
    Image|endswith:
      -'\procmon.exe'
      -'\procmon64.exe'
      -'\procmon64a.exe'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Some false positives may occur with legitimate renamed process monitor binaries
Level: medium