Suspicious PROCEXP152.sys File Created In Temporary Folder

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (Kernel Driver Utility) or Ghost-In-The-Logs, which uses KDU. This activity can indicate an attempt to load a malicious driver for defense evasion or other purposes.