Potential Defense Evasion Via Binary Rename

SigmaHQ Detections@sigmaHQ

•updated Jun 11, 2026•0•0•3

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.