Title:Potential Fake Instance Of Hxtsr.EXE Executed Status:test Description:HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications.
HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files".
Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe
References: -Internal Research Author: Sreeman Date: 2020-04-17 modified:2024-02-08 Tags:
-'attack.stealth'
-'attack.t1036'
Logsource:
product: windows
category: process_creation
Detection: selection: Image|endswith:
'\hxtsr.exe' filter_main_hxtsr: Image|contains:
':\program files\windowsapps\microsoft.windowscommunicationsapps_' Image|endswith:
'\hxtsr.exe' condition:selection and not 1 of filter_main_* Falsepositives:
-Unknown Level:medium
