Windows Renamed ftp.exe Execution via OriginalFileName PE Metadata
Flags Windows executions where PE OriginalFileName is ftp.exe but the image path is not named ftp.exe.
- Product
- windows
- Category
- process_creation
- Author
- Victor Sergeev, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-09
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation where the PE metadata OriginalFileName is set to "ftp.exe" while the running image path does not end with "\ftp.exe". Renaming a copied or staged ftp.exe can help attackers blend into expected tooling and evade simple filename-based detections. Telemetry relies on Windows process creation events that include the executable path and PE metadata fields such as OriginalFileName.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Renamed ftp.exe Execution via OriginalFileName PE Metadata
id: 135ec584-1a35-420e-a858-98b09842bdbe
status: test
description: This rule identifies process creation where the PE metadata OriginalFileName is set to "ftp.exe" while the running image path does not end with "\ftp.exe". Renaming a copied or staged ftp.exe can help attackers blend into expected tooling and evade simple filename-based detections. Telemetry relies on Windows process creation events that include the executable path and PE metadata fields such as OriginalFileName.
references:
- https://lolbas-project.github.io/lolbas/Binaries/Ftp/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_ftp.yml
author: Victor Sergeev, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2023-02-03
tags:
- attack.execution
- attack.stealth
- attack.t1059
- attack.t1202
logsource:
category: process_creation
product: windows
detection:
selection_original:
OriginalFileName: ftp.exe
filter_img:
Image|endswith: \ftp.exe
condition: selection_original and not filter_img
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_ftp/info.yml
license: DRL-1.1
related:
- id: 277a4393-446c-449a-b0ed-7fdc7795244c
type: derived