Ps.exe Renamed SysInternals Tool Execution by Dragonfly APT

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•23

Detects the execution of a renamed SysInternals tool, specifically 'ps.exe', with command-line arguments '-accepteula' and '-s cmd /c netstat'. This specific combination has been observed in attacks attributed to the Dragonfly APT group and is documented in the US-CERT TA17-293A alert.