Unusual use of a 'SysInternals' tool

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2026-04-13

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Obfuscated Files or Information (T1027)
Severity	Informational

An attacker may be trying to avoid detection by using an obfuscated copy of SysInternals tools.

Attackers may leverage SysInternals tools for lateral movement, credential access, or to delete recovery backups to cause impact.

Check if the file is familiar to the user, if not, investigate further the source of it.

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Obfuscated Files or Information (T1027)
Severity	High

An attacker may be trying to avoid detection by using an obfuscated copy of SysInternals tools.

Attackers may leverage SysInternals tools for lateral movement, credential access, or to delete recovery backups to cause impact.

Check if the file is familiar to the user, if not, investigate further the source of it.

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Obfuscated Files or Information (T1027)
Severity	High

An attacker may be trying to avoid detection by using an obfuscated copy of SysInternals tools.

Attackers may leverage SysInternals tools for lateral movement, credential access, or to delete recovery backups to cause impact.

Check if the file is familiar to the user, if not, investigate further the source of it.

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Obfuscated Files or Information (T1027)
Severity	Informational

A registry key related to SysInternals was modified by a known registry editor to circumvent a EULA prompt.

Attackers may leverage SysInternals tools for lateral movement, credential access, or to delete recovery backups to cause impact.

Check if the file is familiar to the user, if not, investigate further the source of it.