title: Ps.exe Renamed SysInternals Tool
id: 18da1007-3f26-470f-875d-f77faf1cab31
status: test
description: Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report
author: Florian Roth
references:
  - https://www.us-cert.gov/ncas/alerts/TA17-293A
date: 2017/10/22
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: 'ps.exe -accepteula'
  condition: selection
falsepositives:
  - Renamed SysInternals tool
level: high
tags:
  - attack.defense_evasion
  - attack.g0035
  - attack.t1036.003
  - car.2013-05-009
