Unusual use of a 'SysInternals' tool

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Obfuscated Files or Information (T1027)
Severity	Informational

An attacker may be trying to avoid detection by using obfuscated copy of SysInternals tools.

Attacker may use SysInternals tools for lateral movement, credentials access or delete recovery backups for impact.

Check if the file is familiar to the user, if not, investigate further the source of it.

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Obfuscated Files or Information (T1027)
Severity	High

An attacker may be trying to avoid detection by using obfuscated copy of SysInternals tools.

Attacker may use SysInternals tools for lateral movement, credentials access or delete recovery backups for impact.

Check if the file is familiar to the user, if not, investigate further the source of it.

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Obfuscated Files or Information (T1027)
Severity	High

An attacker may be trying to avoid detection by using obfuscated copy of SysInternals tools.

Attacker may use SysInternals tools for lateral movement, credentials access or delete recovery backups for impact.

Check if the file is familiar to the user, if not, investigate further the source of it.