Lazarus System Binary Masquerading from Non-Standard Path

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•25

This rule detects instances where specific system binaries (msdtc.exe or gpsvc.exe) are executed from non-standard Windows system directories. This behavior is often indicative of masquerading, where malicious executables are named after legitimate system processes to evade detection, a tactic known to be used by the Lazarus Group.