Potential Defense Evasion Via Binary Rename
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND ORIGINALFILENAME = "Cmd.Exe,CONHOST.EXE,7z.exe,7za.exe,WinRAR.exe,wevtutil.exe,net.exe,net1.exe,netsh.exe,InstallUtil.exe" AND PROCESSNAME notendswith "\cmd.exe,\conhost.exe,\7z.exe,\7za.exe,\WinRAR.exe,\wevtutil.exe,\net.exe,\net1.exe,\netsh.exe,\InstallUtil.exe" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Matthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades)
