Sysinternals Executable Written to Disk
Detects Windows PE executable files written to disk with company metadata matching Sysinternals (Sysinternals - www.sysinternals.com). This detection identifies the presence of Sysinternals tools on endpoints for security monitoring and investigation. Sysinternals tools are legitimate administrative utilities but may also be leveraged by threat actors for reconnaissance, process inspection, credential access, and lateral movement. Review the file path, SHA-256 hash, user context, and associated process activity to determine whether the file is authorized or potentially suspicious. Note: The presence of a Sysinternals executable alone does not indicate malicious activity.
CQL
