1type: trigger
2name: sigmahq/proc_creation_win_renamed_binary_highly_relevant
3description: |
4 Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.
5filter: |
6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.Description == 'Execute processes remotely' || evt.Parsed.Product == 'Sysinternals PsExec' || evt.Parsed.Description startsWith 'Windows PowerShell' || evt.Parsed.Description startsWith 'pwsh' || evt.Parsed.OriginalFileName in ['certutil.exe', 'cmstp.exe', 'cscript.exe', 'mshta.exe', 'msiexec.exe', 'powershell_ise.exe', 'powershell.exe', 'psexec.c', 'psexec.exe', 'psexesvc.exe', 'pwsh.dll', 'reg.exe', 'regsvr32.exe', 'rundll32.exe', 'WerMgr', 'wmic.exe', 'wscript.exe']) && not (evt.Parsed.Image endsWith '\\certutil.exe' || evt.Parsed.Image endsWith '\\cmstp.exe' || evt.Parsed.Image endsWith '\\cscript.exe' || evt.Parsed.Image endsWith '\\mshta.exe' || evt.Parsed.Image endsWith '\\msiexec.exe' || evt.Parsed.Image endsWith '\\powershell_ise.exe' || evt.Parsed.Image endsWith '\\powershell.exe' || evt.Parsed.Image endsWith '\\psexec.exe' || evt.Parsed.Image endsWith '\\psexec64.exe' || evt.Parsed.Image endsWith '\\PSEXESVC.exe' || evt.Parsed.Image endsWith '\\pwsh.exe' || evt.Parsed.Image endsWith '\\reg.exe' || evt.Parsed.Image endsWith '\\regsvr32.exe' || evt.Parsed.Image endsWith '\\rundll32.exe' || evt.Parsed.Image endsWith '\\wermgr.exe' || evt.Parsed.Image endsWith '\\wmic.exe' || evt.Parsed.Image endsWith '\\wscript.exe'))
7blackhole: 2m
8
9labels:
10 service: windows
11 confidence: 1
12 spoofable: 0
13 classification:
14 - attack.t1036.003
15
16 label: "Potential Defense Evasion Via Rename Of Highly Relevant Binaries"
17 behavior : "windows:audit"
18 remediation: false
19
20scope:
21 type: ParentProcessId
22 expression: evt.Parsed.ParentProcessId
23
24
