Renamed Process (Sysmon)

id: '15063.22366'
title: Renamed Process
description: 'Adversaries may attempt to manipulate features of their artifacts to
  make them appear legitimate or benign to users and/or security tools. Masquerading
  occurs when the name or location of an object, legitimate or malicious, is manipulated
  or abused for the sake of evading defenses and observation. This may include manipulating
  file metadata, tricking users into misidentifying the file type, and giving legitimate
  task or service names. This use case compares the process'' original file name to
  the process name at execution. Some legitimate processes may be renamed in normal
  operation and should be allowlisted by file name, process path, and commands where
  applicable to reduce false positives. This detection is based on features unique
  to SysMon and therefore requires SysMon 10.0 or later. -- Threat Actor Association:
  SideWinder -- Atomics T1036.003 Test #1 Atomics T1036.003 Test #3 Atomics T1036.003
  Test #4 Atomics T1036.003 Test #5 Atomics T1036.003 Test #6 Atomics T1036.003 Test
  #7 Atomics T1036.003 Test #8 Atomics T1036.003 Test #9'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "EventID>1<")
  (cmd.exe OR powershell.exe OR pwsh.exe OR powershell_ise.exe) | eval OriginalFileNameFormatted=lower(OriginalFileName),
  process_exec_formatted=lower(process_exec)| rex field=OriginalFileNameFormatted
  mode=sed s/\.\w{3}$//g| rex field=process_exec_formatted mode=sed s/\.\w{3}$//g|
  where process_exec_formatted != OriginalFileNameFormatted and !match(OriginalFileName,
  "\?|^-$")| table _time, host, user, process, process_*, parent_process_name, OriginalFileName
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:masquerading
- defense-evasion:masquerading:rename system utilities
technique_id:
- T1036
- T1036.003
data_category:
- Windows Sysmon
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.md
- https://medium.com/@olafhartong/sysmon-10-0-new-features-and-changes-e82106f2e00
- https://www.group-ib.com/blog/hunting-sidewinder/