Potential Defense Evasion Via Rename Of Highly Relevant Binaries
Detects the execution of a binary that has been renamed from its original name, often used by attackers or malware for defense evasion. This rule leverages the Sysmon 'OriginalFileName' datapoint to identify instances where common Windows utilities or attacker tools are executed under a different filename.
Sigma
