Sigma rule: Potential Defense Evasion Via Binary Rename

Rule

Title

Potential Defense Evasion Via Binary Rename

Status

test

Level

medium

Author

Matthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades)

Date

2019-06-15

Modified

2026-06-05

File

rules/windows/process_creation/proc_creation_win_renamed_binary.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Log source

product

windows

category

process_creation

Detection

selection:
    OriginalFileName:
        - 'Cmd.Exe'
        - 'CONHOST.EXE'
        - '7z.exe'
        - '7za.exe'
        - '7zr.exe'
        - 'WinRAR.exe'
        - 'wevtutil.exe'
        - 'net.exe'
        - 'net1.exe'
        - 'netsh.exe'
        - 'InstallUtil.exe'
filter:
    Image|endswith:
        - '\cmd.exe'
        - '\conhost.exe'
        - '\7z.exe'
        - '\7za.exe'
        - '\7zr.exe'
        - '\WinRAR.exe'
        - '\wevtutil.exe'
        - '\net.exe'
        - '\net1.exe'
        - '\netsh.exe'
        - '\InstallUtil.exe'
condition: selection and not filter

False positives (as the rule lists them)

• Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist

Tags

• attack.stealth
• attack.t1036.003

MITRE ATT&CK ids this rule names

• T1036.003

Related rules

• 0ba1da6d-b6ce-4366-828c-18826c9de23e (similar)

References

• https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html
• https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html
• https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1036.003/T1036.003.md#atomic-test-1---masquerading-as-windows-lsass-process
• https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_renamed_binary.yml