Windows Process Creation: Remote Utilities renamed to rutserv.exe or rfusclient.exe
Alerts on suspicious Windows execution tied to "Remote Utilities" where the image does not match known rutserv.exe/rfusclient.exe names.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-19
- Updated
- 2026-07-30
What it detects
This rule flags Windows process executions where the process metadata indicates the Product as "Remote Utilities" but the executable path is not one of the known Remote Utilities client binary filenames. Renaming legitimate-looking binaries is a common attacker technique to evade allowlists and make malicious activity blend in with expected software artifacts. The detection relies on process creation telemetry, specifically the Product field and the image path ending in \rutserv.exe or \rfusclient.exe.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Remote Utilities renamed to rutserv.exe or rfusclient.exe"
id: a6e6fa3a-bc54-4ed5-9518-ca69fa1d374c
status: test
description: This rule flags Windows process executions where the process metadata indicates the Product as "Remote Utilities" but the executable path is not one of the known Remote Utilities client binary filenames. Renaming legitimate-looking binaries is a common attacker technique to evade allowlists and make malicious activity blend in with expected software artifacts. The detection relies on process creation telemetry, specifically the Product field and the image path ending in \rutserv.exe or \rfusclient.exe.
references:
- https://redcanary.com/blog/misbehaving-rats/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_rurat.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-19
modified: 2023-02-03
tags:
- attack.collection
- attack.command-and-control
- attack.discovery
- attack.stealth
- attack.s0592
logsource:
category: process_creation
product: windows
detection:
selection:
Product: Remote Utilities
filter:
Image|endswith:
- \rutserv.exe
- \rfusclient.exe
condition: selection and not filter
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 9ef27c24-4903-4192-881a-3adde7ff92a5
type: derived