Potential Binary Impersonating Sysinternals Tools
This rule detects the execution of binaries that are named similarly to legitimate Sysinternals tools but lack the expected digital signature or product information. Adversaries often rename their malicious tools to impersonate legitimate software like Sysinternals utilities to evade detection and appear less suspicious.
Sigma
