Renamed PAExec Execution
Detects the execution of PAExec, a legitimate remote administration tool, when its executable name has been changed from the default 'PAExec.exe'. Adversaries often rename legitimate tools like PAExec to evade detection by security products that might flag the original executable name. The rule identifies PAExec based on its internal metadata (Description, OriginalFileName, Product) or specific IMPHASH values, and then filters out instances where the executable retains its original name or is executed from a known PAExec-specific directory created by the tool itself (e.g., C:\Windows\PAExec-XXXXX-ComputerName). This helps to focus on suspicious renamed executions.
Sigma
