huntrule

Windows Renamed ftp.exe Execution via OriginalFileName PE Metadata

Flags Windows executions where PE OriginalFileName is ftp.exe but the image path is not named ftp.exe.

FreeUnreviewedSigmamediumv1
title: Windows Renamed ftp.exe Execution via OriginalFileName PE Metadata
id: 135ec584-1a35-420e-a858-98b09842bdbe
status: test
description: This rule identifies process creation where the PE metadata OriginalFileName is set to "ftp.exe" while the running image path does not end with "\ftp.exe". Renaming a copied or staged ftp.exe can help attackers blend into expected tooling and evade simple filename-based detections. Telemetry relies on Windows process creation events that include the executable path and PE metadata fields such as OriginalFileName.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Ftp/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_ftp.yml
author: Victor Sergeev, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2023-02-03
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection_original:
    OriginalFileName: ftp.exe
  filter_img:
    Image|endswith: \ftp.exe
  condition: selection_original and not filter_img
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_ftp/info.yml
license: DRL-1.1
related:
  - id: 277a4393-446c-449a-b0ed-7fdc7795244c
    type: derived

What it detects

This rule identifies process creation where the PE metadata OriginalFileName is set to "ftp.exe" while the running image path does not end with "\ftp.exe". Renaming a copied or staged ftp.exe can help attackers blend into expected tooling and evade simple filename-based detections. Telemetry relies on Windows process creation events that include the executable path and PE metadata fields such as OriginalFileName.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.