Masquerading via Windows Terminal Original Name (wt.exe Impersonation)
This detection identifies potential process masquerading where a binary’s original file name metadata is wt.exe (Windows Terminal), but the actual running process name differs. Adversaries often tamper with PE metadata or rename binaries to evade detection and blend into legitimate processes. In this case, attackers may: - Modify the OriginalFileName field in the PE header to wt.exe - Execute a malicious binary under a different filename - Attempt to bypass allowlists or detection logic relying on trusted binaries like Windows Terminal This detection flags inconsistencies between: actor_process_image_name (actual process name) actor_process_file_original_name (PE metadata)
Cortex XDR
