Windows Process Creation: Suspicious Renamed Binary Masquerading as Common Tools

title: "Windows Process Creation: Suspicious Renamed Binary Masquerading as Common Tools"
id: 0f83d3ea-bec3-4147-a892-4ae9f487e876
related:
  - id: 0ba1da6d-b6ce-4366-828c-18826c9de23e
    type: similar
  - id: 36480ae1-a1cb-4eaa-a0d6-29801d7e9142
    type: derived
status: test
description: This rule identifies process creations where the Sysmon OriginalFileName matches well-known binaries (for example cmd.exe, conhost.exe, 7z/WinRAR, wevtutil, net/netsh, InstallUtil) but the executed Image ends with a differently named binary. Such mismatches are a common defense-evasion technique used to masquerade malicious execution as legitimate Windows utilities. It relies on Windows process creation telemetry that includes both Image and Sysmon OriginalFileName fields to spot inconsistencies. The logic excludes cases where the Image already ends with the expected original names to reduce straightforward matches.
references:
  - https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html
  - https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html
  - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1036.003/T1036.003.md#atomic-test-1---masquerading-as-windows-lsass-process
  - https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_binary.yml
author: Matthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades), Huntrule Team
date: 2019-06-15
modified: 2026-06-05
tags:
  - attack.stealth
  - attack.t1036.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    OriginalFileName:
      - Cmd.Exe
      - CONHOST.EXE
      - 7z.exe
      - 7za.exe
      - 7zr.exe
      - WinRAR.exe
      - wevtutil.exe
      - net.exe
      - net1.exe
      - netsh.exe
      - InstallUtil.exe
  filter:
    Image|endswith:
      - \cmd.exe
      - \conhost.exe
      - \7z.exe
      - \7za.exe
      - \7zr.exe
      - \WinRAR.exe
      - \wevtutil.exe
      - \net.exe
      - \net1.exe
      - \netsh.exe
      - \InstallUtil.exe
  condition: selection and not filter
falsepositives:
  - Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_binary/info.yml
license: DRL-1.1