Detectionmediumtest

Process Launched Without Image Name

Detect the use of processes with no name (".exe"), which can be used to evade Image-based detections.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Matt Anderson (Huntress)Created Tue Jul 23f208d6d8-d83a-4c2c-960d-877c37da84e5windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image|endswith: '\.exe'
    condition: selection

False Positives

Rare legitimate software.

References

MITRE ATT&CK

Tactics

Rule Metadata

Rule ID

f208d6d8-d83a-4c2c-960d-877c37da84e5

Status

test

Level

medium

Type

Detection

Created

Tue Jul 23

Author

Path

rules/windows/process_creation/proc_creation_win_susp_no_image_name.yml

Raw Tags

attack.defense-evasion