Windows Process Creation: Replace.exe with -a Argument

Detects Replace.exe executions that include the -a argument, which may be used for file replacement.

FreeUnreviewedSigmamediumv1

windows-process-creation-replace-exe-with-a-argument-9292293b

title: "Windows Process Creation: Replace.exe with -a Argument"
id: 4ad7141f-329f-436d-adc9-0d9b82eda7c5
status: test
description: This rule flags execution of Replace.exe on Windows when the command line includes the -a switch. Replace.exe can be abused to overwrite or swap files, which attackers may use to stage or persist malicious content. The detection relies on process creation telemetry capturing the executed image path and the full command line arguments.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Replace/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/replace
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_replace.yml
author: frack113, Huntrule Team
date: 2022-03-06
modified: 2024-03-13
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \replace.exe
  argument:
    CommandLine|contains|windash: -a
  condition: selection and argument
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9292293b-8496-4715-9db6-37028dcda4b3
    type: derived

What it detects

This rule flags execution of Replace.exe on Windows when the command line includes the -a switch. Replace.exe can be abused to overwrite or swap files, which attackers may use to stage or persist malicious content. The detection relies on process creation telemetry capturing the executed image path and the full command line arguments.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.