Potential Defense Evasion Via Rename Of Highly Relevant Binaries

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2026•0•0•1

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.