Detectionmediumtest

Lolbin Runexehelper Use As Proxy

Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

François HubautCreated Thu Dec 29cd71385d-fd9b-4691-9b98-2b1f7e508714windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        ParentImage|endswith: '\runexehelper.exe'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

cd71385d-fd9b-4691-9b98-2b1f7e508714

Status

test

Level

medium

Type

Detection

Created

Thu Dec 29

Author

Path

rules/windows/process_creation/proc_creation_win_lolbin_runexehelper.yml

Raw Tags

attack.defense-evasionattack.t1218