Windows Process Creation: Replace.exe with -a argument

Detects Replace.exe executions that include the -a argument, which may be used for file replacement.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-03-06
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1105Ingress Tool Transfer
Exfiltration
Impact

What it detects

This rule identifies execution of Replace.exe where the command line includes the '-a' switch. Replace.exe can be used to replace one file with another, a capability that may support unauthorized file modification or persistence. Detection relies on Windows process creation telemetry capturing the executable path and command-line arguments.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange

Suspicious File Download via CertUtil URLCache (via process_creation)

Suspicious PowerShell Download of Disguised Payload to ProgramData

Suspicious PowerShell WebClient Download of Executable Payload

Malicious JADEPUFFER Lockd Ransomware Payload Download

Malicious Second-Stage Loader Fetch of SLT Payload via Curl or Wget

Possible Remote Payload Download And Execution via Shell (via process_creation)

Suspicious EtherRAT Node.js Implant Background Execution via Shell (via process_creation)

Suspicious Certutil Download and Certificate Installation via Living-off-the-Land

Suspicious PowerShell Remote Script Execution via IEX DownloadString

Windows Process Creation: Replace.exe with -a argument

Pivot detection · T1105 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-replace-exe-with-a-argument-9292293b

title: "Windows Process Creation: Replace.exe with -a argument"
id: 4ad7141f-329f-436d-adc9-0d9b82eda7c5
status: test
description: This rule identifies execution of Replace.exe where the command line includes the '-a' switch. Replace.exe can be used to replace one file with another, a capability that may support unauthorized file modification or persistence. Detection relies on Windows process creation telemetry capturing the executable path and command-line arguments.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Replace/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/replace
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_replace.yml
author: frack113, Huntrule Team
date: 2022-03-06
modified: 2024-03-13
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \replace.exe
  argument:
    CommandLine|contains|windash: -a
  condition: selection and argument
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9292293b-8496-4715-9db6-37028dcda4b3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL