Sigma rule: Potential Defense Evasion Via Rename Of Highly Relevant Binaries

Rule

Title

Potential Defense Evasion Via Rename Of Highly Relevant Binaries

Status

test

Level

high

Author

Matthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113

Date

2019-06-15

Modified

2026-06-29

File

rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Log source

product

windows

category

process_creation

Detection

selection:
    - Description: 'Execute processes remotely'
    - Product: 'Sysinternals PsExec'
    - Description|startswith:
          - 'Windows PowerShell'
          - 'pwsh'
    - OriginalFileName:
          - 'certutil.exe'
          - 'cmstp.exe'
          - 'cscript.exe'
          - 'IE4UINIT.EXE'
          - 'finger.exe'
          - 'mshta.exe'
          - 'msiexec.exe'
          - 'msxsl.exe'
          - 'powershell_ise.exe'
          - 'powershell.exe'
          - 'psexec.c'        # old versions of psexec (2016 seen)
          - 'psexec.exe'
          - 'psexesvc.exe'
          - 'pwsh.dll'
          - 'reg.exe'
          - 'regsvr32.exe'
          - 'rundll32.exe'
          - 'WerMgr'
          - 'wmic.exe'
          - 'wscript.exe'
filter:
    Image|endswith:
        - '\certutil.exe'
        - '\cmstp.exe'
        - '\cscript.exe'
        - '\ie4uinit.exe'
        - '\finger.exe'
        - '\mshta.exe'
        - '\msiexec.exe'
        - '\msxsl.exe'
        - '\powershell_ise.exe'
        - '\powershell.exe'
        - '\psexec.exe'
        - '\psexec64.exe'
        - '\psexec64a.exe'
        - '\PSEXESVC.exe'
        - '\pwsh.exe'
        - '\reg.exe'
        - '\regsvr32.exe'
        - '\rundll32.exe'
        - '\wermgr.exe'
        - '\wmic.exe'
        - '\wscript.exe'
condition: selection and not filter

False positives (as the rule lists them)

• Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist
• PsExec installed via Windows Store doesn't contain original filename field (False negative)

Tags

• attack.stealth
• attack.t1036.003
• car.2013-05-009

MITRE ATT&CK ids this rule names

• T1036.003

Related rules

• 36480ae1-a1cb-4eaa-a0d6-29801d7e9142 (similar)
• 2569ed8c-1147-498a-9b8c-2ad3656b10ed (derived)
• a7a7e0e5-1d57-49df-9c58-9fe5bc0346a2 (obsolete)
• d178a2d7-129a-4ba4-8ee6-d6e1fecd5d20 (obsolete)
• d4d2574f-ac17-4d9e-b986-aeeae0dc8fe2 (obsolete)

References

• https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html
• https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html
• https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks
• https://twitter.com/christophetd/status/1164506034720952320
• https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/
• https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant.yml