<<< Hide Navigation Hide TOC >>>

Process Explorer Driver Creation By Non-Sysinternals Binary (de46c52b-0bf8-4936-a327-aace94f94ac6)

Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself. Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.

Rows: 1

Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

---

TableFilter v0.7.2

https://www.tablefilter.com/
©2015-2025 Max Guglielmi

Close

?

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
	Clear Attack Pattern		Clear Sigma-Rules	Clear 1
Exploitation for Privilege Escalation - T1068 (b21c3b2d-02e6-45b1-980b-e69051040839)	Attack Pattern	Process Explorer Driver Creation By Non-Sysinternals Binary (de46c52b-0bf8-4936-a327-aace94f94ac6)	Sigma-Rules	1