Thread by @therealwlambert

🦖Day 14 of the @velocidex #velociraptor #ArtifactsOfAutumn series

Artifact: 'Windows[.]Detection[.]BinaryRename'

Author: @mgreen27

Link: docs.velociraptor.app/exchange/artif…

This artifact will detect renamed binaries commonly abused by adversaries.

Renaming binaries is a defense evasion technique used to bypass brittle process name and path-based detections. It is used by many actors/groups, including from commodity malware and nation states.

Here, we can see 'cmd.exe' was renamed in an attempt to appear as a legitimate instance of 'lsass.exe':

You can try this out by following along with the Atomic Red Team test, found here:

atomicredteam.io/defense-evasio…

Also, check out this great article by Matt:

mgreen27.github.io/posts/2019/05/…

Also check out MITRE's ATT&CK page for renaming system utilities:
attack.mitre.org/techniques/T10…

That's it for now! Stay tuned to learn about more artifacts! 🦖

#DFIR
#Infosec
#T1036

* Link: docs.velociraptor.app/artifact_refer…