Sigma rule: Suspicious PROCEXP152.sys File Created In TMP

Rule

Title

Suspicious PROCEXP152.sys File Created In TMP

Status

test

Level

medium

Author

xknow (@xknow_infosec), xorxes (@xor_xes)

Date

2019-04-08

Modified

2026-06-29

File

rules/windows/file/file_event/file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder.
This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU.

Log source

product

windows

category

file_event

Detection

selection:
    TargetFilename|contains: '\AppData\Local\Temp\'
    TargetFilename|endswith: 'PROCEXP152.sys'
filter:
    Image|contains:
        - '\procexp64.exe'
        - '\procexp64a.exe'
        - '\procexp.exe'
        - '\procmon64.exe'
        - '\procmon64a.exe'
        - '\procmon.exe'
condition: selection and not filter

False positives (as the rule lists them)

• Other legimate tools using this driver and filename (like Sysinternals). Note - Clever attackers may easily bypass this detection by just renaming the driver filename. Therefore just Medium-level and don't rely on it.

Tags

• attack.defense-impairment
• attack.t1685

MITRE ATT&CK ids this rule names

• T1685

References

• https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml