{"id":"36480ae1-a1cb-4eaa-a0d6-29801d7e9142","title":"Potential Defense Evasion Via Binary Rename","description":"Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.","author":"Matthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades)","status":"test","level":"medium","date":"2019-06-15","modified":"2026-06-05","tags":["attack.stealth","attack.t1036.003"],"technique_ids":["T1036.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist"],"references":["https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html","https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html","https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1036.003/T1036.003.md#atomic-test-1---masquerading-as-windows-lsass-process","https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html"],"source_path":"rules/windows/process_creation/proc_creation_win_renamed_binary.yml","source_sha256":"a381cae336ef1c927002d4c9f0503fa2eab1325c7a9c1df20c6fe291a4f16330","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_binary.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Defense Evasion Via Binary Rename\nid: 36480ae1-a1cb-4eaa-a0d6-29801d7e9142\nrelated:\n    - id: 0ba1da6d-b6ce-4366-828c-18826c9de23e\n      type: similar\nstatus: test\ndescription: Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.\nreferences:\n    - https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html\n    - https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html\n    - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1036.003/T1036.003.md#atomic-test-1---masquerading-as-windows-lsass-process\n    - https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html\nauthor: Matthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades)\ndate: 2019-06-15\nmodified: 2026-06-05\ntags:\n    - attack.stealth\n    - attack.t1036.003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName:\n            - 'Cmd.Exe'\n            - 'CONHOST.EXE'\n            - '7z.exe'\n            - '7za.exe'\n            - '7zr.exe'\n            - 'WinRAR.exe'\n            - 'wevtutil.exe'\n            - 'net.exe'\n            - 'net1.exe'\n            - 'netsh.exe'\n            - 'InstallUtil.exe'\n    filter:\n        Image|endswith:\n            - '\\cmd.exe'\n            - '\\conhost.exe'\n            - '\\7z.exe'\n            - '\\7za.exe'\n            - '\\7zr.exe'\n            - '\\WinRAR.exe'\n            - '\\wevtutil.exe'\n            - '\\net.exe'\n            - '\\net1.exe'\n            - '\\netsh.exe'\n            - '\\InstallUtil.exe'\n    condition: selection and not filter\nfalsepositives:\n    - Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist\nlevel: medium\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_binary/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036.003","id":"T1036.003","name":"Rename Legitimate Utilities","page":"techniques/enterprise/T1036.003/"}],"data_path":"data/detection-rules/36480ae1-a1cb-4eaa-a0d6-29801d7e9142.json","kind":"sigma"}