Utility executing under a name its own PE metadata contradicts

Siemphony@siemphonymediumT1036.003unverified

Matches the first half of AN0012 inside a single Sysmon EventID 1 record: the PE version resource still names the utility the compiler built (`OriginalFileName`), while the file on disk has been given some other name — which is exactly what renaming rundll32.exe, or shipping a copy of PsExec as something else, produces. Both halves are needed, because the metadata on its own is just the tool running normally and the file name on its own says nothing, so the selection lists original names and a filter drops every event whose `Image` still ends in one of the matching real names. That list is MITRE's `PEInternalNameMismatch` knob, populated here with the system binaries and LOLBAS the analytic names plus the closely related script hosts; the two values that look wrong are not — PsExec's version resource carries `psexec.c` and rundll32's carries `RUNDLL.EXE`, so those are what a renamed copy reports. Three limits are structural. The filter is not paired name-for-name, so a utility renamed to another entry's real name (rundll32.exe copied to cmd.exe) is filtered out rather than matched. An adversary who strips or forges the version resource before use removes the only field this rule reads. And `OriginalFileName` is a Sysmon field: this rule is written in the Sysmon process-creation vocabulary, and on a Security 4688 feed mapped onto the same Sigma category that field does not exist at all, so no audit policy makes the rule work there — it needs Sysmon EventID 1 with a configuration that does not exclude these images. The analytic's Sysmon EventID 11 leg is not attempted, and neither are its macOS (AN0013) or Linux (AN0014) siblings; the copied-to-a-non-standard-directory case MITRE describes alongside renaming is a path observable rather than a metadata one and is authored under T1036.005. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0005, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((ProcessVersionInfoOriginalFileName =~ "PowerShell.EXE" or ProcessVersionInfoOriginalFileName =~ "Cmd.Exe" or ProcessVersionInfoOriginalFileName =~ "RUNDLL.EXE" or ProcessVersionInfoOriginalFileName =~ "REGSVR32.EXE" or ProcessVersionInfoOriginalFileName =~ "MSHTA.EXE" or ProcessVersionInfoOriginalFileName =~ "CertUtil.exe" or ProcessVersionInfoOriginalFileName =~ "wscript.exe" or ProcessVersionInfoOriginalFileName =~ "cscript.exe" or ProcessVersionInfoOriginalFileName =~ "wmic.exe" or ProcessVersionInfoOriginalFileName =~ "bitsadmin.exe" or ProcessVersionInfoOriginalFileName =~ "psexec.c") and not ((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\wmic.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\psexec.exe" or FolderPath endswith "\\psexec64.exe")))

Splunk · SPL

Run this as a search.

index=* ((OriginalFileName="PowerShell.EXE" OR OriginalFileName="Cmd.Exe" OR OriginalFileName="RUNDLL.EXE" OR OriginalFileName="REGSVR32.EXE" OR OriginalFileName="MSHTA.EXE" OR OriginalFileName="CertUtil.exe" OR OriginalFileName="wscript.exe" OR OriginalFileName="cscript.exe" OR OriginalFileName="wmic.exe" OR OriginalFileName="bitsadmin.exe" OR OriginalFileName="psexec.c") AND NOT ((Image="*\\powershell.exe" OR Image="*\\cmd.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\mshta.exe" OR Image="*\\certutil.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\wmic.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\psexec.exe" OR Image="*\\psexec64.exe")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.pe.original_file_name) == "powershell.exe" OR TO_LOWER(process.pe.original_file_name) == "cmd.exe" OR TO_LOWER(process.pe.original_file_name) == "rundll.exe" OR TO_LOWER(process.pe.original_file_name) == "regsvr32.exe" OR TO_LOWER(process.pe.original_file_name) == "mshta.exe" OR TO_LOWER(process.pe.original_file_name) == "certutil.exe" OR TO_LOWER(process.pe.original_file_name) == "wscript.exe" OR TO_LOWER(process.pe.original_file_name) == "cscript.exe" OR TO_LOWER(process.pe.original_file_name) == "wmic.exe" OR TO_LOWER(process.pe.original_file_name) == "bitsadmin.exe" OR TO_LOWER(process.pe.original_file_name) == "psexec.c") AND NOT ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wmic.exe" OR TO_LOWER(process.executable) LIKE "*\\\\bitsadmin.exe" OR TO_LOWER(process.executable) LIKE "*\\\\psexec.exe" OR TO_LOWER(process.executable) LIKE "*\\\\psexec64.exe")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="OriginalFileName" type="pcre2">(?i)(^PowerShell\.EXE$|^Cmd\.Exe$|^RUNDLL\.EXE$|^REGSVR32\.EXE$|^MSHTA\.EXE$|^CertUtil\.exe$|^wscript\.exe$|^cscript\.exe$|^wmic\.exe$|^bitsadmin\.exe$|^psexec\.c$)</field>    <field name="Image" negate="yes" type="pcre2">(?i)(\\powershell\.exe$|\\cmd\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\mshta\.exe$|\\certutil\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\wmic\.exe$|\\bitsadmin\.exe$|\\psexec\.exe$|\\psexec64\.exe$)</field>    <description>Utility executing under a name its own PE metadata contradicts</description>    <mitre>      <id>T1036.003</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: masquerading
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 6afbf203-c5bc-4360-8a69-27856084c118

ATT&CKT1036.003

T1036.003Rename Legitimate Utilities

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonmasquerading

masqueradingAI draft — unreviewed

01 · What this rule detects

A Windows utility running under a file name its own PE metadata contradicts. Sysmon lifts OriginalFileName out of the binary's version resource, and that value does not change when someone copies rundll32.exe to svc-update.exe. The rule is the first half of AN0012: metadata saying one thing, file name saying another, both settled inside a single process-creation event.

02 · Telemetry you need

Sysmon EventID 1, under Sigma's process_creation / product: windows category. OriginalFileName is a Sysmon field and only a Sysmon field. On a Security 4688 feed mapped into the same Sigma category it does not exist, so no audit policy makes this rule work there — it needs Sysmon with a configuration that does not exclude these images. If your Sysmon config filters out the common LOLBAS to cut volume, the rule is blind rather than quiet.

03 · How the logic works

selection_metadata lists eleven OriginalFileName values. Two look like typos and are not: PsExec's version resource carries psexec.c and rundll32's carries RUNDLL.EXE, so those are what a renamed copy actually reports. This list is MITRE's PEInternalNameMismatch knob; AN0012 names three of the values (rundll32, powershell, psexec), the script hosts are closely related, and cmd, regsvr32, mshta, certutil, wmic and bitsadmin were added here by the pipeline. Metadata alone is just the tool running normally, so filter_matching_name excludes every event whose Image still ends in one of the matching real names. The condition is selection_metadata and not filter_matching_name — original name recognised, on-disk name not the one that belongs to it. The filter is flat, not paired name-for-name, and that is a real hole: a monitored utility renamed to another entry's real name — rundll32.exe copied to cmd.exe — lands in the selection and is then excused by the filter. Renaming to a second common Microsoft binary is a first-choice move, so this sits in the core case, not at the edge. Stripping or forging the version resource defeats the rule outright.

04 · Common false positives

Redistributed PsExec dominates. Remote-support suites, deployment tools and in-house admin kits ship it as psexec_x64.exe, a product-named runner or a randomised service binary, and the resource still reads psexec.c. Portable toolkits carrying their own cmd.exe or cscript.exe, installers extracting a private certutil.exe under a bundle-specific name, and EDR self-tests copying system binaries to working directories all match honestly.

05 · Detection maturity

tier_1: Lowest tier. This rule has never been run against a log line; the selections, the filter and the level are all reasoned from MITRE prose. It also covers one of three arms — AN0012's Sysmon EventID 11 leg and the macOS (AN0013) and Linux (AN0014) siblings are unauthored, so treat DET0005 as roughly a third covered. Nothing rises above scaffold until you have run it, measured the volume and recorded which allowlist entries were needed.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline before enabling. Pull a week of OriginalFileName mismatches, then allowlist by full Image path — not by name — for the deployment and support tooling you own. The reviewer's stronger option: pull psexec.c into its own rule so the remaining ten, whose renamed form is far rarer benignly, can carry a level the noise supports. As written, level: medium sits above what its own loudest false positive argues for, and PsExec is simultaneously the noisiest entry and one of AN0012's named examples, so a medium alert cannot be triaged apart. Low is the defensible setting until you have baselined.

Declared by the author

Sysinternals PsExec redistributed under a different file name. Remote-support suites, software-deployment tools and in-house admin toolkits routinely ship it as psexec_x64.exe, a product-named runner or a randomised service binary, and the version resource still reads psexec.c. In most enterprises this is the loudest entry on the list by a wide margin, and it is why the level is medium rather than high.
Portable toolkits and self-contained build or field-service environments that carry their own copy of a Microsoft utility under a suite-specific name so they do not depend on the system copy. PortableApps launchers, vendor USB support kits and some CI agent bundles do this with cmd.exe, cscript.exe and wscript.exe.
Installers and updaters that extract a private copy of certutil.exe, wmic.exe or bitsadmin.exe into a temporary directory under a randomised or bundle-specific file name during setup; the extracted file keeps the original version resource, so the mismatch is real and benign.
Detection-engineering and application-compatibility tooling that copies a system binary to a working directory under a test name and runs it there, including EDR self-tests, atomic-test harnesses and sandbox agents on analyst workstations.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Not verified

Security Datasets — Masquerading as a system binary
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1036.003, evaluated against their process_creation events.

Share this rule

/u/siemphony/6afbf203-c5bc-4360-8a69-27856084c118

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Utility executing under a name its own PE metadata contradicts

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it