{"id":"0ba1da6d-b6ce-4366-828c-18826c9de23e","title":"Potential Defense Evasion Via Rename Of Highly Relevant Binaries","description":"Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.","author":"Matthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113","status":"test","level":"high","date":"2019-06-15","modified":"2026-02-12","tags":["attack.stealth","attack.t1036.003","car.2013-05-009"],"technique_ids":["T1036.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist","PsExec installed via Windows Store doesn't contain original filename field (False negative)"],"references":["https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html","https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html","https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks","https://twitter.com/christophetd/status/1164506034720952320","https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/","https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke"],"source_path":"rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant.yml","source_sha256":"9cec6e631f1b1ed9a58a8236d0f8db300ca6a1ceb48bfdad058c6fec079806ba","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Defense Evasion Via Rename Of Highly Relevant Binaries\nid: 0ba1da6d-b6ce-4366-828c-18826c9de23e\nrelated:\n    - id: 36480ae1-a1cb-4eaa-a0d6-29801d7e9142\n      type: similar\n    - id: 2569ed8c-1147-498a-9b8c-2ad3656b10ed # Renamed Rundll32 Specific\n      type: derived\n    - id: a7a7e0e5-1d57-49df-9c58-9fe5bc0346a2 # Renamed PsExec\n      type: obsolete\n    - id: d178a2d7-129a-4ba4-8ee6-d6e1fecd5d20 # Renamed PowerShell\n      type: obsolete\n    - id: d4d2574f-ac17-4d9e-b986-aeeae0dc8fe2 # Renamed Rundll32\n      type: obsolete\nstatus: test\ndescription: Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.\nreferences:\n    - https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html\n    - https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html\n    - https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks\n    - https://twitter.com/christophetd/status/1164506034720952320\n    - https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/\n    - https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke\nauthor: Matthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113\ndate: 2019-06-15\nmodified: 2026-02-12\ntags:\n    - attack.stealth\n    - attack.t1036.003\n    - car.2013-05-009\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Description: 'Execute processes remotely'\n        - Product: 'Sysinternals PsExec'\n        - Description|startswith:\n              - 'Windows PowerShell'\n              - 'pwsh'\n        - OriginalFileName:\n              - 'certutil.exe'\n              - 'cmstp.exe'\n              - 'cscript.exe'\n              - 'IE4UINIT.EXE'\n              - 'finger.exe'\n              - 'mshta.exe'\n              - 'msiexec.exe'\n              - 'msxsl.exe'\n              - 'powershell_ise.exe'\n              - 'powershell.exe'\n              - 'psexec.c'        # old versions of psexec (2016 seen)\n              - 'psexec.exe'\n              - 'psexesvc.exe'\n              - 'pwsh.dll'\n              - 'reg.exe'\n              - 'regsvr32.exe'\n              - 'rundll32.exe'\n              - 'WerMgr'\n              - 'wmic.exe'\n              - 'wscript.exe'\n    filter:\n        Image|endswith:\n            - '\\certutil.exe'\n            - '\\cmstp.exe'\n            - '\\cscript.exe'\n            - '\\ie4uinit.exe'\n            - '\\finger.exe'\n            - '\\mshta.exe'\n            - '\\msiexec.exe'\n            - '\\msxsl.exe'\n            - '\\powershell_ise.exe'\n            - '\\powershell.exe'\n            - '\\psexec.exe'\n            - '\\psexec64.exe'\n            - '\\PSEXESVC.exe'\n            - '\\pwsh.exe'\n            - '\\reg.exe'\n            - '\\regsvr32.exe'\n            - '\\rundll32.exe'\n            - '\\wermgr.exe'\n            - '\\wmic.exe'\n            - '\\wscript.exe'\n    condition: selection and not filter\nfalsepositives:\n    - Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist\n    - PsExec installed via Windows Store doesn't contain original filename field (False negative)\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036.003","id":"T1036.003","name":"Rename Legitimate Utilities","page":"techniques/enterprise/T1036.003/"}],"data_path":"data/detection-rules/0ba1da6d-b6ce-4366-828c-18826c9de23e.json","kind":"sigma"}