Replace.exe with Add Argument Usage
Detects the use of 'replace.exe' with the '-a' argument, which is used to add new files to the destination directory. This utility can be abused by adversaries to replace or add files on a system, potentially for persistence, defense evasion, or to introduce malicious tools.
Sigma
