Query: rule covering Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName data
Matching passage: Sigma rule: Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName data. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Via Binary Rename id: 36480ae1-a1cb-4eaa-a0d6-29801d7e9142 related: - id: 0ba1da6d-b6ce-4366-828c-18826c9de23e type: similar status: test description: Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint. references: - https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html - https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1036.003/T1036.003.md#atomic-test-1---masquerading-as-windows-lsass-process - https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html author: Matthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades) date: 2019-06-15 modified: 2026-06-05 tags: - attack.stealth - attack.t1036.003 logsource: category: process_creation product: windows detection: selection: OriginalFileName: - Cmd.Exe - CONHOST.EXE - 7z.exe - 7za.exe - 7zr.exe - WinRAR.exe - wevtutil.exe - net.exe - net1.exe - netsh.exe - InstallUtil.exe filter: Image|endswith: - \cmd.exe - \conhost.exe - \7z.exe - \7za.exe - \7zr.exe - \WinRAR.exe - \wevtutil.exe - \net.exe - \net1.exe - \netsh.exe - \InstallUtil.exe condition: selection and not filter falsepositives: - Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_binary/info.yml
Near-miss passage: Sigma rule: Detects use of Cobalt Strike commands accidentally entered in the CMD shell. Logsource: windows / process_creation. Rule: title: Operator Bloopers Cobalt Strike Commands id: 647c7b9e-d784-4fda-b9a0-45c565a7b729 related: - id: 4f154fb6-27d1-4813-a759-78b93e0b9c48 type: similar status: test description: Detects use of Cobalt Strike commands accidentally entered in the CMD shell references: - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/cobalt-4-5-user-guide.pdf - https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/ - https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/ author: _pete_0, TheDFIRReport date: 2022-05-06 modified: 2023-01-30 tags: - attack.execution - attack.t1059.003 - stp.1u logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: Cmd.Exe - Image|endswith: \cmd.exe selection_cli: CommandLine|startswith: - 'cmd ' - cmd.exe - c:\windows\system32\cmd.exe CommandLine|contains: - psinject - spawnas - make_token - remote-exec - rev2self - dcsync - logonpasswords - execute-assembly - getsystem condition: all of selection_* falsepositives: - Unknown level: high