Renamed BOINC Client Execution
This rule detects the execution of the BOINC client binary when it has been renamed from its original filename 'BOINC.exe'. Adversaries may rename legitimate binaries to evade detection, often as part of defense evasion tactics. This specific detection looks for processes where the original filename is 'BOINC.exe' but the executed image path does not end with '\BOINC.exe'.
Sigma
