detection.wiki

Detection rules › Sigma

Potential Defense Evasion Via Binary Rename

Status
test
Severity
medium
Log source
product windows, category process_creation
Author
Matthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades)
Source
github.com/SigmaHQ/sigma

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

MITRE ATT&CK coverage

TacticTechniques
StealthT1036.003 Masquerading: Rename Legitimate Utilities

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Potential Defense Evasion Via Binary Rename
id: 36480ae1-a1cb-4eaa-a0d6-29801d7e9142
related:
    - id: 0ba1da6d-b6ce-4366-828c-18826c9de23e
      type: similar
status: test
description: Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.
references:
    - https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html
    - https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html
    - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1036.003/T1036.003.md#atomic-test-1---masquerading-as-windows-lsass-process
    - https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html
author: Matthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades)
date: 2019-06-15
modified: 2026-06-05
tags:
    - attack.stealth
    - attack.t1036.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        OriginalFileName:
            - 'Cmd.Exe'
            - 'CONHOST.EXE'
            - '7z.exe'
            - '7za.exe'
            - '7zr.exe'
            - 'WinRAR.exe'
            - 'wevtutil.exe'
            - 'net.exe'
            - 'net1.exe'
            - 'netsh.exe'
            - 'InstallUtil.exe'
    filter:
        Image|endswith:
            - '\cmd.exe'
            - '\conhost.exe'
            - '\7z.exe'
            - '\7za.exe'
            - '\7zr.exe'
            - '\WinRAR.exe'
            - '\wevtutil.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\netsh.exe'
            - '\InstallUtil.exe'
    condition: selection and not filter
falsepositives:
    - Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_binary/info.yml

Stages and Predicates

Stage 0: condition

selection and not filter

Stage 1: selection

selection:
    OriginalFileName:
        - 'Cmd.Exe'
        - 'CONHOST.EXE'
        - '7z.exe'
        - '7za.exe'
        - '7zr.exe'
        - 'WinRAR.exe'
        - 'wevtutil.exe'
        - 'net.exe'
        - 'net1.exe'
        - 'netsh.exe'
        - 'InstallUtil.exe'

Stage 2: not filter

filter:
    Image|endswith:
        - '\cmd.exe'
        - '\conhost.exe'
        - '\7z.exe'
        - '\7za.exe'
        - '\7zr.exe'
        - '\WinRAR.exe'
        - '\wevtutil.exe'
        - '\net.exe'
        - '\net1.exe'
        - '\netsh.exe'
        - '\InstallUtil.exe'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
Imageends_with\7z.exe
Imageends_with\7za.exe
Imageends_with\7zr.exe
Imageends_with\InstallUtil.exe
Imageends_with\WinRAR.exe
Imageends_with\cmd.exe
Imageends_with\conhost.exe
Imageends_with\net.exe
Imageends_with\net1.exe
Imageends_with\netsh.exe
Imageends_with\wevtutil.exe

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
OriginalFileNameeq
  • 7z.exe corpus 5 (sigma 4, splunk 1)
  • 7za.exe corpus 5 (sigma 4, splunk 1)
  • 7zr.exe corpus 5 (sigma 4, splunk 1)
  • CONHOST.EXE corpus 2 (sigma 2)
  • Cmd.Exe corpus 65 (sigma 43, splunk 17, elastic 5)
  • InstallUtil.exe corpus 11 (sigma 6, splunk 4, elastic 1)
  • WinRAR.exe corpus 3 (sigma 1, elastic 1, splunk 1)
  • net.exe corpus 28 (sigma 19, elastic 7, splunk 2)
  • net1.exe corpus 44 (sigma 19, splunk 19, elastic 6)
  • netsh.exe corpus 23 (sigma 14, splunk 7, elastic 2)
  • wevtutil.exe corpus 7 (sigma 5, elastic 1, splunk 1)