Sysmon Process Create Event

A subject uses utilities to compress and/or encrypt collected data prior to exfiltration.

A subject installs software onto an organization-managed system without prior approval or outside sanctioned methods (e.g., centralized package management, internal software portals). This behavior spans a spectrum of risk - from seemingly benign installations (e.g., video games, personal browsers, media players) to unauthorized deployment of potentially harmful tools sourced from unvetted repositories or adversarial infrastructure.

The infringement may involve:

• Manual download and execution of installer packages
• Use of administrative access to bypass endpoint restrictions
• Cloning or compiling code from external code repositories such as GitHub

While some installations may appear harmless, unapproved software installs can represent a breakdown in configuration control and acceptable use. In high-risk scenarios, such software may introduce remote access mechanisms, data exfiltration capabilities, or other malware. Even benign cases signal behavioral drift, particularly when repeated or ignored, and can contribute to software sprawl, policy erosion, or eventual exploitation.

A subject may install or attempt to install software that will be used to exfiltrate sensitive data or contravene internal policies.

A subject can leverage software approved for installation or software that is already installed.

A subject can access the web with an organization device.

Private browsing, also known as 'incognito mode' among other terms, is a feature in modern web browsers that prevents the storage of browsing history, cookies, and site data on a subject's device. When private browsing is enabled, it ensures any browsing activity conducted during the browser session is not saved to the browser history or cache.

A subject can use private browsing to conceal their actions in a web browser, such as navigating to unauthorized websites, downloading illicit materials, uploading corporate data or conducting covert communications, thus leaving minimal traces of their browsing activities on a device and frustrating forensic recovery efforts.

The subject leverages virtualization technologies—including hypervisors and virtual machines—to obscure forensic artifacts, isolate malicious activity, or evade host-based monitoring. By conducting operations within a guest operating system, the subject reduces visibility to host-level security tools and complicates the forensic process by separating volatile and persistent data across system boundaries.

This strategy allows the subject to:

• Contain incriminating tools, logs, or staged data entirely within a VM.
• Avoid leaving artifacts on the host system's registry, file system, or memory.
• Leverage disposable VMs to execute high-risk actions and erase evidence through snapshot rollback or VM deletion.
• Evade host-based endpoint detection and response (EDR) tools that lack introspection into virtualized environments.
• Run guest OSes in stealth configurations (e.g., nested VMs, portable hypervisors) to further frustrate attribution and recovery efforts.

The subject intentionally alters or removes log entries, either at the host, application, or network level, in a deliberate attempt to conceal or misrepresent their actions. This behavior is typically executed to frustrate forensic reconstruction during an investigation and may include deletion of individual log lines, rewriting timestamps, or manipulating source IPs or usernames.

Subjects engaging in this technique may use native administrative tools (e.g., PowerShell, auditpol, journalctl), third-party log scrubbers, or direct file system access to tamper with .evtx, .log, or flat text logs.

The subject uses applications, binaries, scripts, services, or administrative utilities already trusted or commonly present within the organizational environment to support or conceal an infringement without introducing new software.

Trusted tool misuse may involve operating system utilities, command and scripting environments, archive tools, managed browsers, synchronization clients, productivity applications, remote management components, or administrative consoles. Because these capabilities are routinely used for legitimate purposes, the subject’s activity may avoid software installation alerts, application control restrictions, and indicators associated with unfamiliar executables.

The anti-forensic significance arises where the subject deliberately selects a trusted capability to reduce detection, obscure intent, or make unauthorized activity appear consistent with normal operational use. Investigators should assess the subject’s role, command-line activity, file access, timing, tool combinations, and surrounding investigative indicators. The execution of a trusted tool should not be treated as inherently suspicious.

Example Behaviors

• Using a signed operating-system binary to execute unauthorized code while avoiding controls focused on unknown executables.
• Using PowerShell, Windows Command Shell, Terminal, or a Unix shell to collect, copy, encode, alter, or remove information.
• Using a built-in archive utility to stage sensitive files without installing external compression software.
• Using an approved browser, synchronization client, collaboration platform, or cloud service to transfer information through activity that resembles routine business use.
• Using native screenshot, clipboard, print, preview, export, or file-management functions to collect or alter information without specialist tooling.
• Using a trusted administrative utility or indirect execution pathway to perform unauthorized activity while reducing distinct control violations.
• Using scheduled tasks, launch agents, login items, shortcuts, or existing automation features to repeat activity without introducing new software.

A subject deploys or uses rootkit functionality to conceal programs, files, processes, network connections, services, drivers, accounts, or other system components from security monitoring and subsequent investigation.

Rootkits manipulate or intercept operating system functions responsible for reporting system activity, causing affected components to be omitted, altered, or misrepresented when reviewed through conventional administrative or forensic tools. Rootkit functionality may operate within user space, the operating system kernel, a hypervisor, or system firmware.

The subject modifies a system, application, or operating environment to preserve unauthorized access, execution, or control beyond the initial activity. The persistence mechanism is intended to remain available following events that would ordinarily interrupt the subject’s access, including system restart, user logoff, application termination, credential changes, or the subject’s departure from the organization.

System persistence may be established through the creation or modification of scheduled tasks, cron jobs, system services, startup items, Registry autorun locations, login scripts, systemd units, Windows Management Instrumentation event subscriptions, SSH authorized keys, web shells, application extensions, or other automatically executed components. The subject may create a new persistence mechanism or alter an existing legitimate component so that unauthorized code, commands, or remote-access functionality is invoked without requiring repeated manual action.

This behavior is preparatory where the subject establishes the mechanism before an intended infringement, allowing access or execution to continue at a later time or under conditions in which the subject’s normal account is unavailable. Persistence may support subsequent unauthorized access, data collection, sabotage, surveillance, or execution by another party.

The subject causes a newly created process to record or present a false parent process identifier, obscuring the process responsible for initiating the activity. This creates a misleading parent-child relationship within process trees and may cause unauthorized execution to appear as though it originated from a trusted, routine, or unrelated process. This Section concerns the deliberate falsification of process ancestry to evade monitoring, conceal the origin of execution, or frustrate subsequent investigation.

Parent process ID spoofing can undermine detections based on expected process lineage and complicate forensic reconstruction of the execution chain. The subject may use process-creation application programming interfaces or specialist tooling to assign an alternate parent process when launching code.

A subject uses utilities to compress and/or encrypt collected data prior to exfiltration.

A subject uses utilities to compress and/or encrypt collected data prior to exfiltration.

A subject uses utilities to compress collected data prior to exfiltration.

A subject uses utilities to encrypt collected data prior to exfiltration.

A subject exfiltrates information using a messaging application that is already installed on the system. They will access the conversation at a later date to retrieve information on a different system.

A subject installs screen sharing software which can be used to capture images or other information from a target system.

A subject installs a Remote Desktop Protocol (RDP) client which can be used to access RDP servers across a network.

A subject installs a File Transfer Protocol (FTP) client which can be used to access FTP servers across the a network.

A subject installs a Secure Shell (SSH) client, which can be used to access SSH servers across a network.

A subject installs an unapproved messenger application with the ability to transmit data and/or files across the Internet.

A subject installs an unapproved note taking application with the ability to sync notes across the Internet.

A subject can install an unapproved cloud storage application that has the ability to sync files across the Internet.

A subject can install an unapproved browser with features that frustrate or prevent preventions or detections, such as built-in VPN, Tor access, or automatic browser artifact destruction.

A subject installs a VPN application that allows them to tunnel their traffic.

A subject installs a hypervisor that allows them to create and access virtual environments on a device.

A subject installs software that is not considered appropriate by the organization.

A subject installs software that is not inherently malicious, but is not wanted, commonly known as “greyware” or “potentially unwanted programs”.

A USB to USB data transfer cable is a device designed to connect two computers directly together for the purpose of transferring files between them. These cables are equipped with a small electronic circuit to facilitate data transfer without the need for an intermediate storage device. Typically a USB to USB data transfer cable will require specific software to be installed to facilitate the data transfer. In the context of an insider threat, a USB to USB data transfer cable can be a tool for exfiltrating sensitive data from an organization's environment.

A subject exfiltrates data outside of the organization's control using the built-in file transfer capabilities of software such as Teamviewer.

A subject attempts to identify security software by monitoring network traffic.

The subject uses a virtual machine (VM) on an organization device to contain artifacts of forensic value within the virtualized environment, preventing them from being written to the host file system. This strategy helps to obscure evidence and complicate forensic investigations.
 

By running a guest operating system within a VM, the subject can potentially evade detection by security agents installed on the host operating system, as these agents may not have visibility into activities occurring within the VM. This adds an additional layer of complexity to forensic analysis, making it more challenging to detect and attribute malicious activities.

The subject leverages Windows Subsystem for Linux (WSL) to contain forensic artifacts within a Linux-like runtime environment embedded in Windows. By operating inside WSL, the subject avoids writing sensitive data, tool activity, or command history to traditional Windows locations, significantly reducing visibility to host-based forensic and security tools.

WSL creates a logical Linux environment that appears separate from the Windows file system. Although some host-guest integration exists, activity within WSL often bypasses standard Windows event logging, registry updates, and process tracking. This allows the subject to execute scripts, use Unix-native tools, stage exfiltration, or decrypt payloads with minimal footprint on the host.

Example Scenarios:

• The subject downloads and processes sensitive files inside the WSL environment using native Linux tools (e.g., scp, gpg, rsync), preventing access and modification timestamps from appearing in Windows Explorer or standard audit logs.
• A subject extracts and stages exfiltration material in /mnt/c within WSL, using symbolic links and Linux file permissions to obscure its presence from Windows search and indexing services.
• WSL is used to execute recon and credential-harvesting scripts (e.g., nmap, hydra, ssh enumeration tools), with no execution trace in Windows Event Logs.
• Upon completion of activity, the subject deletes the WSL distribution, leaving minimal residue on the host system—especially if no antivirus or EDR coverage extends into the WSL layer.

The subject installs a browser capable of accessing anonymity networks, such as the Tor Browser (used for .onion sites), I2P Router Console, or Freenet, as part of preparation for covert research, anonymous communication, or unmonitored data exchange. This behavior may support future infringement by enabling non-attributable activity outside sanctioned IT controls.

Installation of the Tor Browser Bundle typically involves downloading a signed executable or compressed package from https://www.torproject.org, executing an installer that unpacks a portable browser (a custom-hardened Firefox variant), and launching start-tor-browser.exe—which spawns both the Tor daemon (tor.exe) and the browser instance (firefox.exe) in a sandboxed environment. Configuration files such as torrc may be modified to enable pluggable transports (e.g., obfs4, meek) designed to evade deep packet inspection (DPI) or proxy enforcement.

In environments with proxy filtering, the subject may attempt to chain Tor through bridge relays or VPNs, obfuscate traffic using SOCKS5 tunneling, or execute from non-standard directories (e.g., cloud-sync folders, external volumes). Some subjects bypass endpoint controls entirely by booting into live-operating systems (e.g., Tails, Whonix) which route all system traffic through Tor by default and leave minimal forensic artifacts on host storage.

This installation is rarely accidental and often coincides with other policy evasions or drift indicators. The presence of anonymizing tools—even in dormant form—warrants scrutiny as a preparatory indicator linked to potential data exfiltration, credential harvesting, or external coordination.

The subject deploys a Remote Access Tool (RAT): a software implant that provides covert, persistent remote control of an endpoint or server—enabling continued unauthorized access, monitoring, or post-employment re-entry. Unlike sanctioned remote administration platforms, RATs are deployed without organizational oversight and are often configured to obfuscate their presence, evade detection, or blend into legitimate activity.

RATs deployed by insiders may be off-the-shelf tools (e.g. njRAT, Quasar, Remcos), lightly modified open-source frameworks (e.g. Havoc, Pupy), or commercial-grade products repurposed for unsanctioned use (e.g. AnyDesk, TeamViewer in stealth mode). 

Functionality typically includes:

• Full GUI or shell access
• File system interaction
• Screenshot and webcam capture
• Credential harvesting
• Process and registry manipulation
• Optional keylogging and persistence modules

Deployment methods include manual installation, script-wrapped droppers, DLL side-loading, or execution via LOLBins (mshta, rundll32). Persistence is typically achieved through scheduled tasks, registry run keys, or disguised service installations. In some cases, the RAT may be configured to activate only during specific windows or respond to remote beacons, reducing exposure to detection.

The subject creates or modifies a scheduled task, cron job, system timer, or equivalent mechanism to execute unauthorized commands or code automatically at a future time or recurring interval.

The subject creates or modifies a system service, daemon, launch agent, or equivalent background component to execute unauthorized functionality automatically or continuously.

The subject modifies startup folders, Registry autorun locations, XDG autostart entries, login items, shortcuts, or equivalent configurations so that unauthorized code executes during system startup or account logon.

The subject creates or modifies an event subscription, event handler, system hook, or equivalent trigger that executes unauthorized commands or code when specified conditions are met.

The subject installs or modifies an extensible server component, stored procedure, transport agent, server module, service library, or virtualization package to preserve unauthorized execution or access.

This Sub-section excludes web shells, which are represented separately under PR046.006 – Web Shell Deployment.

The subject uses a network-accessible administrative service or operating-system management interface to access resources, transfer content, execute commands, or perform actions on an additional organizational system without establishing an ordinary interactive desktop session.

Methods may include Server Message Block (SMB), Windows administrative shares, Distributed Component Object Model (DCOM), Windows Remote Management (WinRM), or remote Windows Management Instrumentation (WMI).

The subject takes control of an existing authenticated remote service session to operate an additional organizational system under the identity and access context of the session owner. The subject may hijack an active or disconnected RDP session, reuse an SSH agent or socket, or otherwise attach to a pre-existing remote session without completing a new authentication process.

The subject exploits a vulnerability in a network-accessible service, application, management interface, operating-system component, or hypervisor to obtain unauthorized access or execution capability on an additional organizational system.

This object applies as Preparation where exploitation is used to reach or establish an operating position on a destination system before a later infringement. Where the exploitation itself causes the principal harm, disruption, or unauthorized modification, investigators should also apply the relevant Infringement section.

The subject exploits a vulnerability in an operating system, application, kernel component, service, driver, hypervisor, container runtime, or other privileged software to obtain permissions beyond their existing execution context.

This Sub-section applies as Preparation where exploitation increases the subject’s capability before a later infringement. Where the exploitation itself causes the principal harm, unauthorized modification, or operational disruption, investigators should also apply the relevant Infringement.

The subject modifies an application, executable, library, extension, runtime component, or processing pathway so that organizational data is altered as it is accessed, processed, rendered, or displayed.

The underlying stored data may remain unchanged while an operator, customer, investigator, or decision-maker is presented with inaccurate, incomplete, suppressed, or substituted information. The behavior may conceal transactions, alter displayed values, omit selected records, or cause an application to present information that differs from its authoritative source.