Execution of binaries where the on-disk filename does not match PE metadata such as OriginalFilename or InternalName. Often observed with renamed LOLBAS or system binaries like rundll32, powershell, or psexec.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| File Creation (DC0039) | WinEventLog:Sysmon | EventCode=11 |
| Command Execution (DC0064) | EDR:AMSI | None |
| Field | Description |
|---|---|
| ImagePath | Filter by suspicious or non-standard directory paths |
| PEInternalNameMismatch | Enable tuning based on mismatch rules between metadata and disk filename |
| CommandLinePattern | Flag unusual or rare argument combinations for LOLBAS-like tools |
Execution of renamed or relocated native macOS utilities with uncommon names or non-default paths (e.g., renamed osascript, bash, or curl).
| Data Component | Name | Channel |
|---|---|---|
| Process Metadata (DC0034) | macos:unifiedlog | subsystem=com.apple.process |
| Process Creation (DC0032) | macos:endpointsecurity | ES_EVENT_TYPE_NOTIFY_EXEC |
| File Modification (DC0061) | fs:fileevents | /var/log/quarantine.log |
| Field | Description |
|---|---|
| PathDeviation | Path deviation from expected directory (e.g., /usr/bin/ vs /tmp/) |
| BinaryHashReputation | Enable tuning based on hash matching known signed versions vs suspicious clones |
| UserRole | Scope detections based on non-admin users using admin-level tools |
Execution of renamed common utilities (e.g., bash, nc, python, sh) from atypical directories or with names intended to deceive defenders or EDRs.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | execve |
| File Metadata (DC0059) | linux:osquery | event-based |
| Command Execution (DC0064) | linux:syslog | /var/log/syslog or journalctl |
| Field | Description |
|---|---|
| ExecutionPath | Path anomalies such as execution from /dev/shm, /tmp, or user home directories |
| ParentProcessContext | Unusual lineage such as scripts invoking renamed tools |
| TimeWindow | Correlate between file rename and immediate execution |