Windows Process Creation: Replace.exe with -a argument
Detects Replace.exe executions that include the -a argument, which may be used for file replacement.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-03-06
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies execution of Replace.exe where the command line includes the '-a' switch. Replace.exe can be used to replace one file with another, a capability that may support unauthorized file modification or persistence. Detection relies on Windows process creation telemetry capturing the executable path and command-line arguments.
Reporting behind it
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Replace/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/replace
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_replace.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-replace-exe-with-a-argument-9292293b
title: "Windows Process Creation: Replace.exe with -a argument"
id: 4ad7141f-329f-436d-adc9-0d9b82eda7c5
status: test
description: This rule identifies execution of Replace.exe where the command line includes the '-a' switch. Replace.exe can be used to replace one file with another, a capability that may support unauthorized file modification or persistence. Detection relies on Windows process creation telemetry capturing the executable path and command-line arguments.
references:
- https://lolbas-project.github.io/lolbas/Binaries/Replace/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/replace
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_replace.yml
author: frack113, Huntrule Team
date: 2022-03-06
modified: 2024-03-13
tags:
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \replace.exe
argument:
CommandLine|contains|windash: -a
condition: selection and argument
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 9292293b-8496-4715-9db6-37028dcda4b3
type: derived