Execution via Renamed Signed Binary Proxy
Description
Identifies built-in Windows programs that have been renamed and can be used for execution, downloads, and/or evasion. Attackers may abuse this tactic to evade filename based detection of built-in tools.
Query · eql
process where event.action == "start" and
process.name != null and
(
(process.pe.original_file_name == "cscript.exe" and not process.name : "cscript.exe") or
(process.pe.original_file_name == "wscript.exe" and not process.name : "wscript.exe") or
(process.pe.original_file_name == "PowerShell.EXE" and not process.name : "PowerShell.EXE") or
(process.pe.original_file_name == "Cmd.Exe" and not process.name : ("Cmd.Exe", "command.com")) or
(process.pe.original_file_name == "MSHTA.EXE" and not process.name : "MSHTA.EXE") or
(process.pe.original_file_name == "RUNDLL32.EXE" and not process.name : "RUNDLL32.EXE") or
(process.pe.original_file_name == "REGSVR32.EXE" and not process.name : "REGSVR32.EXE") or
(process.pe.original_file_name == "MSBuild.exe" and not process.name : "MSBuild.exe") or
(process.pe.original_file_name == "InstallUtil.exe" and not process.name : "InstallUtil.exe") or
(process.pe.original_file_name == "RegAsm.exe" and not process.name : "RegAsm.exe") or
(process.pe.original_file_name == "RegSvcs.exe" and not process.name : "RegSvcs.exe") or
(process.pe.original_file_name == "msxsl.exe" and not process.name : "msxsl.exe") or
(process.pe.original_file_name == "Microsoft.Workflow.Compiler.exe" and
not process.name : "Microsoft.Workflow.Compiler.exe") or
(process.pe.original_file_name == "msiexec.exe" and not process.name : "msiexec.exe" and
not process.executable : "?:\\Windows\\Installer\\MSI*.tmp") or
(process.pe.original_file_name == "CMSTP.EXE" and not process.name : "CMSTP.EXE") or
(process.pe.original_file_name == "bitsadmin.exe" and not process.name : "bitsadmin.exe") or
(process.pe.original_file_name == "CertUtil.exe" and not process.name : "CertUtil.exe") or
(process.pe.original_file_name == "wmic.exe" and not process.name : "wmic.exe") or
(process.pe.original_file_name == "schtasks.exe" and not process.name : "schtasks.exe") or
(process.pe.original_file_name == "wuauclt.exe" and not process.name : "wuauclt.exe") or
(process.pe.original_file_name == "Bginfo.exe" and not process.name : "Bginfo*.exe") or
(process.pe.original_file_name == "VsJITDebugger.exe" and not process.name : "VsJITDebugger.exe") or
(process.pe.original_file_name == "xwizard.exe" and not process.name : "xwizard.exe") or
(process.pe.original_file_name == "extexport.exe" and not process.name : "extexport.exe") or
(process.pe.original_file_name == "CertReq.exe" and not process.name : "CertReq.exe") or
(process.pe.original_file_name == "bsdtar" and not process.name : "tar.exe" and
process.code_signature.subject_name == "Microsoft Windows") or
(process.pe.original_file_name : "GfxDownloadWrapper.exe" and not process.name : "GfxDownloadWrapper.exe") or
(process.pe.original_file_name : "devinit.dll" and
process.code_signature.subject_name : "Microsoft *" and not process.name : "devinit.exe") or
(process.pe.original_file_name == "DumpMinitool.exe" and
process.code_signature.subject_name : "Microsoft *" and not process.name : "DumpMinitool.exe") or
(process.pe.original_file_name == "curl.exe" and
process.code_signature.subject_name : "Microsoft *" and not process.name : "curl.exe")
) and
/* some third party programs tend to include renamed binaries, still often run from trusted paths */
not process.executable :
(
"?:\\Windows\\System32\\*.exe",
"?:\\Windows\\SysWOW64\\*.exe",
"?:\\Program Files (x86)\\*.exe",
"?:\\Program Files\\*.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\*.exe",
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\*.exe",
"\\Device\\HarddiskVolume*\\Windows\\Microsoft.NET\\*.exe",
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*.exe",
"\\Device\\HarddiskVolume*\\Program Files\\*.exe"
) and
not (process.executable : "?:\\Windows\\Installer\\MSI*.tmp" and process.parent.name : "msiexec.exe") and
not (process.hash.sha256 == "505d886fff0542f600f8534d9691de02200b719f1b80487a84fa799e1b178696" and
process.executable == "C:\\spmwin\\regasm32.exe") and
not (process.parent.executable : "C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHActiveDefense.exe" and
process.pe.original_file_name == "RUNDLL32.EXE" and process.args : "360ExtremeBrowserURL") and
not (process.name : "regasm.x64.exe" and process.parent.executable : "C:\\Program Files (x86)\\Common Files\\Inlite\\InliteControlCenter.exe") and
not (process.pe.original_file_name == "cscript.exe" and process.parent.executable : "C:\\Program Files (x86)\\Net Protector *\\NPDBKWTT.EXE") and
not (
process.executable : (
"?:\\ProgramData\\Package Cache\\VSTACleanupOldRegistryBundlex64\\cmd_x64.exe",
"?:\\ProgramData\\Package Cache\\VSTACleanupOldRegistryBundlex86\\cmd_x86.exe",
"?:\\ProgramData\\Package Cache\\CleanupOldRegistryBundlex86\\cmd_x86.exe",
"?:\\ProgramData\\Package Cache\\CleanupOldRegistryBundlex64\\cmd_x64.exe"
) and
process.parent.name : ("vsta_setup.exe", "vsta_sdk.exe")
) and
not process.parent.executable : ("C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHSafeTray.exe",
"C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHActiveDefense.exe")