Detection rules › Sigma
Potential Defense Evasion Via Rename Of Highly Relevant Binaries
Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1036.003 Masquerading: Rename Legitimate Utilities |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
title: Potential Defense Evasion Via Rename Of Highly Relevant Binaries
id: 0ba1da6d-b6ce-4366-828c-18826c9de23e
related:
- id: 36480ae1-a1cb-4eaa-a0d6-29801d7e9142
type: similar
- id: 2569ed8c-1147-498a-9b8c-2ad3656b10ed # Renamed Rundll32 Specific
type: derived
- id: a7a7e0e5-1d57-49df-9c58-9fe5bc0346a2 # Renamed PsExec
type: obsolete
- id: d178a2d7-129a-4ba4-8ee6-d6e1fecd5d20 # Renamed PowerShell
type: obsolete
- id: d4d2574f-ac17-4d9e-b986-aeeae0dc8fe2 # Renamed Rundll32
type: obsolete
status: test
description: Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.
references:
- https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html
- https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html
- https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks
- https://twitter.com/christophetd/status/1164506034720952320
- https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/
- https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke
author: Matthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113
date: 2019-06-15
modified: 2026-02-12
tags:
- attack.stealth
- attack.t1036.003
- car.2013-05-009
logsource:
category: process_creation
product: windows
detection:
selection:
- Description: 'Execute processes remotely'
- Product: 'Sysinternals PsExec'
- Description|startswith:
- 'Windows PowerShell'
- 'pwsh'
- OriginalFileName:
- 'certutil.exe'
- 'cmstp.exe'
- 'cscript.exe'
- 'IE4UINIT.EXE'
- 'finger.exe'
- 'mshta.exe'
- 'msiexec.exe'
- 'msxsl.exe'
- 'powershell_ise.exe'
- 'powershell.exe'
- 'psexec.c' # old versions of psexec (2016 seen)
- 'psexec.exe'
- 'psexesvc.exe'
- 'pwsh.dll'
- 'reg.exe'
- 'regsvr32.exe'
- 'rundll32.exe'
- 'WerMgr'
- 'wmic.exe'
- 'wscript.exe'
filter:
Image|endswith:
- '\certutil.exe'
- '\cmstp.exe'
- '\cscript.exe'
- '\ie4uinit.exe'
- '\finger.exe'
- '\mshta.exe'
- '\msiexec.exe'
- '\msxsl.exe'
- '\powershell_ise.exe'
- '\powershell.exe'
- '\psexec.exe'
- '\psexec64.exe'
- '\PSEXESVC.exe'
- '\pwsh.exe'
- '\reg.exe'
- '\regsvr32.exe'
- '\rundll32.exe'
- '\wermgr.exe'
- '\wmic.exe'
- '\wscript.exe'
condition: selection and not filter
falsepositives:
- Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist
- PsExec installed via Windows Store doesn't contain original filename field (False negative)
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant/info.yml
Stages and Predicates
Stage 0: condition
selection and not filterStage 1: selection
selection:
- Description: 'Execute processes remotely'
- Product: 'Sysinternals PsExec'
- Description|startswith:
- 'Windows PowerShell'
- 'pwsh'
- OriginalFileName:
- 'certutil.exe'
- 'cmstp.exe'
- 'cscript.exe'
- 'IE4UINIT.EXE'
- 'finger.exe'
- 'mshta.exe'
- 'msiexec.exe'
- 'msxsl.exe'
- 'powershell_ise.exe'
- 'powershell.exe'
- 'psexec.c'
- 'psexec.exe'
- 'psexesvc.exe'
- 'pwsh.dll'
- 'reg.exe'
- 'regsvr32.exe'
- 'rundll32.exe'
- 'WerMgr'
- 'wmic.exe'
- 'wscript.exe'
Stage 2: not filter
filter:
Image|endswith:
- '\certutil.exe'
- '\cmstp.exe'
- '\cscript.exe'
- '\ie4uinit.exe'
- '\finger.exe'
- '\mshta.exe'
- '\msiexec.exe'
- '\msxsl.exe'
- '\powershell_ise.exe'
- '\powershell.exe'
- '\psexec.exe'
- '\psexec64.exe'
- '\PSEXESVC.exe'
- '\pwsh.exe'
- '\reg.exe'
- '\regsvr32.exe'
- '\rundll32.exe'
- '\wermgr.exe'
- '\wmic.exe'
- '\wscript.exe'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
Image | ends_with | \PSEXESVC.exe |
Image | ends_with | \certutil.exe |
Image | ends_with | \cmstp.exe |
Image | ends_with | \cscript.exe |
Image | ends_with | \finger.exe |
Image | ends_with | \ie4uinit.exe |
Image | ends_with | \mshta.exe |
Image | ends_with | \msiexec.exe |
Image | ends_with | \msxsl.exe |
Image | ends_with | \powershell.exe |
Image | ends_with | \powershell_ise.exe |
Image | ends_with | \psexec.exe |
Image | ends_with | \psexec64.exe |
Image | ends_with | \pwsh.exe |
Image | ends_with | \reg.exe |
Image | ends_with | \regsvr32.exe |
Image | ends_with | \rundll32.exe |
Image | ends_with | \wermgr.exe |
Image | ends_with | \wmic.exe |
Image | ends_with | \wscript.exe |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Description | eq |
|
Description | starts_with |
|
OriginalFileName | eq |
|
Product | eq |
|