Windows Process Creation: Remote Utilities renamed to rutserv.exe or rfusclient.exe

title: "Windows Process Creation: Remote Utilities renamed to rutserv.exe or rfusclient.exe"
id: a6e6fa3a-bc54-4ed5-9518-ca69fa1d374c
status: test
description: This rule flags Windows process executions where the process metadata indicates the Product as "Remote Utilities" but the executable path is not one of the known Remote Utilities client binary filenames. Renaming legitimate-looking binaries is a common attacker technique to evade allowlists and make malicious activity blend in with expected software artifacts. The detection relies on process creation telemetry, specifically the Product field and the image path ending in \rutserv.exe or \rfusclient.exe.
references:
  - https://redcanary.com/blog/misbehaving-rats/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_rurat.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-19
modified: 2023-02-03
tags:
  - attack.collection
  - attack.command-and-control
  - attack.discovery
  - attack.stealth
  - attack.s0592
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Product: Remote Utilities
  filter:
    Image|endswith:
      - \rutserv.exe
      - \rfusclient.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9ef27c24-4903-4192-881a-3adde7ff92a5
    type: derived