Potential Defense Evasion Via Binary Rename

SigmaHQ Detections@sigmaHQ

•updated Jul 16, 2025•1•0•38

Detects the execution of a renamed binary often used by attackers or malware. This rule leverages the Sysmon 'OriginalFileName' data point to identify instances where a process's actual executable name (Image) differs from its original compiled file name. This technique is commonly used for defense evasion to masquerade malicious executables as legitimate system utilities.