Renamed Office Binary Execution
This rule detects the execution of Microsoft Office applications (Excel, Access, Publisher, OneNote, Outlook, PowerPoint, Word) when their executable files have been renamed. It identifies processes where the original file name or description indicates an Office application, but the executed image path does not match the standard, legitimate executable name for that application. This technique is often used by adversaries for defense evasion to bypass security controls that monitor known legitimate application names.
Sigma
