Windows LOLBAS Executed As Renamed File

This analytic identifies a Living Off The Land Binaries and Scripts (LOLBAS) process being executed where its process name does not match its original file name attribute. Processes that have been renamed and executed may indicate an adversary attempting to evade defenses or execute malicious code. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. The detection logic specifically looks for process creation events where the `original_file_name` field (which stores the original name of the executable) does not match the `process_name` (the name of the process as it's currently running). It also filters out common system paths and uses a lookup table (`lolbas_file_path`) to identify known LOLBAS binaries.