Windows: Detect execution of renamed BOINC.exe binary
Flags renamed BOINC executables on Windows by matching OriginalFileName=BOINC.exe when the executed image name differs.
- Product
- windows
- Category
- process_creation
- Author
- Matt Anderson (Huntress) (SigmaHQ), DRL 1.1
- Published
- 2024-07-23
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process creation events where a binary with OriginalFileName set to BOINC.exe is executed under a different filename. Attackers may rename legitimate software to reduce suspicion and evade simple allowlists while maintaining expected functionality. The detection relies on process creation telemetry and the Image path (specifically whether the executable name ends with '\BOINC.exe') alongside the OriginalFileName metadata.
Reporting behind it
- boinc.berkeley.eduhttps://boinc.berkeley.edu/
- virustotal.comhttps://www.virustotal.com/gui/file/91e405e8a527023fb8696624e70498ae83660fe6757cef4871ce9bcc659264d3/details
- huntress.comhttps://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_boinc.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect execution of renamed BOINC.exe binary"
id: a5da1339-a080-49ad-8e99-cdddddcb0dc0
status: test
description: This rule identifies Windows process creation events where a binary with OriginalFileName set to BOINC.exe is executed under a different filename. Attackers may rename legitimate software to reduce suspicion and evade simple allowlists while maintaining expected functionality. The detection relies on process creation telemetry and the Image path (specifically whether the executable name ends with '\BOINC.exe') alongside the OriginalFileName metadata.
references:
- https://boinc.berkeley.edu/
- https://www.virustotal.com/gui/file/91e405e8a527023fb8696624e70498ae83660fe6757cef4871ce9bcc659264d3/details
- https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_boinc.yml
author: Matt Anderson (Huntress), Huntrule Team
date: 2024-07-23
tags:
- attack.defense-impairment
- attack.t1553
logsource:
category: process_creation
product: windows
detection:
selection:
OriginalFileName: BOINC.exe
filter_main_legit_name:
Image|endswith: \BOINC.exe
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 30d07da2-83ab-45d8-ae75-ec7c0edcaffc
type: derived