Windows Process Creation: Suspicious Renamed Binary Masquerading as Common Tools
Flags Windows executions where Sysmon OriginalFileName matches common tools but the process Image name ends differently.
- Product
- windows
- Category
- process_creation
- Author
- Matthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades) (SigmaHQ), DRL 1.1
- Published
- 2019-06-15
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creations where the Sysmon OriginalFileName matches well-known binaries (for example cmd.exe, conhost.exe, 7z/WinRAR, wevtutil, net/netsh, InstallUtil) but the executed Image ends with a differently named binary. Such mismatches are a common defense-evasion technique used to masquerade malicious execution as legitimate Windows utilities. It relies on Windows process creation telemetry that includes both Image and Sysmon OriginalFileName fields to spot inconsistencies. The logic excludes cases where the Image already ends with the expected original names to reduce straightforward matches.
Reporting behind it
- mgreen27.github.iohttps://mgreen27.github.io/posts/2019/05/12/BinaryRename.html
- mgreen27.github.iohttps://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1036.003/T1036.003.md#atomic-test-1---masquerading-as-windows-lsass-process
- splunk.comhttps://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_binary.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Suspicious Renamed Binary Masquerading as Common Tools"
id: 0f83d3ea-bec3-4147-a892-4ae9f487e876
related:
- id: 0ba1da6d-b6ce-4366-828c-18826c9de23e
type: similar
- id: 36480ae1-a1cb-4eaa-a0d6-29801d7e9142
type: derived
status: test
description: This rule identifies process creations where the Sysmon OriginalFileName matches well-known binaries (for example cmd.exe, conhost.exe, 7z/WinRAR, wevtutil, net/netsh, InstallUtil) but the executed Image ends with a differently named binary. Such mismatches are a common defense-evasion technique used to masquerade malicious execution as legitimate Windows utilities. It relies on Windows process creation telemetry that includes both Image and Sysmon OriginalFileName fields to spot inconsistencies. The logic excludes cases where the Image already ends with the expected original names to reduce straightforward matches.
references:
- https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html
- https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html
- https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1036.003/T1036.003.md#atomic-test-1---masquerading-as-windows-lsass-process
- https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_binary.yml
author: Matthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades), Huntrule Team
date: 2019-06-15
modified: 2026-06-05
tags:
- attack.stealth
- attack.t1036.003
logsource:
category: process_creation
product: windows
detection:
selection:
OriginalFileName:
- Cmd.Exe
- CONHOST.EXE
- 7z.exe
- 7za.exe
- 7zr.exe
- WinRAR.exe
- wevtutil.exe
- net.exe
- net1.exe
- netsh.exe
- InstallUtil.exe
filter:
Image|endswith:
- \cmd.exe
- \conhost.exe
- \7z.exe
- \7za.exe
- \7zr.exe
- \WinRAR.exe
- \wevtutil.exe
- \net.exe
- \net1.exe
- \netsh.exe
- \InstallUtil.exe
condition: selection and not filter
falsepositives:
- Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_binary/info.yml
license: DRL-1.1