Rename Legitimate Utilities

let MonitoredUtilities = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "mshta.exe", "certutil.exe", "wscript.exe", "cscript.exe", "regsvr32.exe", "msbuild.exe", "psexec.exe", "psexesvc.exe", "bitsadmin.exe", "wmic.exe"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessVersionInfoOriginalFileName in~ (MonitoredUtilities)
| where FileName !in~ (MonitoredUtilities)
| project Timestamp, DeviceName, AccountName, FileName, FolderPath,
         ProcessVersionInfoOriginalFileName, ProcessVersionInfoProductName,
         ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine,
         SHA256
| sort by Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (OriginalFileName IN ("Cmd.Exe", "PowerShell.EXE", "pwsh.dll", "RUNDLL32.EXE", "MSHTA.EXE", "CertUtil.exe", "wscript.exe", "cscript.exe", "REGSVR32.EXE", "MSBuild.exe", "PsExec.exe", "bitsadmin.exe", "wmic.exe"))
| eval CurrentName=mvindex(split(Image, "\\"), -1)
| where lower(CurrentName)!=lower(OriginalFileName)
| eval RenamedFrom=OriginalFileName, RenamedTo=CurrentName
| table _time, host, User, Image, RenamedFrom, RenamedTo, CommandLine, ParentImage, ParentCommandLine, Hashes
| sort - _time

process where event.type == "start" and
  process.pe.original_file_name in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "mshta.exe", "certutil.exe", "wscript.exe", "cscript.exe", "regsvr32.exe", "msbuild.exe", "psexec.exe", "psexesvc.exe", "bitsadmin.exe", "wmic.exe") and
  not process.name in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "mshta.exe", "certutil.exe", "wscript.exe", "cscript.exe", "regsvr32.exe", "msbuild.exe", "psexec.exe", "psexesvc.exe", "bitsadmin.exe", "wmic.exe")

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  username AS User,
  "OriginalFileName",
  "Image" AS FullImagePath,
  "CommandLine",
  "ParentImage",
  "ParentCommandLine",
  LOGSOURCETYPENAME(logsourcetypeid) AS LogSourceType
FROM events
WHERE
  "EventCode" = '1'
  AND LOGSOURCETYPEID IN (12, 397)
  AND LOWER("OriginalFileName") IN (
    'cmd.exe', 'powershell.exe', 'pwsh.dll', 'rundll32.exe',
    'mshta.exe', 'certutil.exe', 'wscript.exe', 'cscript.exe',
    'regsvr32.exe', 'msbuild.exe', 'psexec.exe', 'psexesvc.exe',
    'bitsadmin.exe', 'wmic.exe'
  )
  AND NOT (
    "Image" ILIKE '%\\cmd.exe' OR "Image" ILIKE '%\\powershell.exe' OR
    "Image" ILIKE '%\\pwsh.exe' OR "Image" ILIKE '%\\rundll32.exe' OR
    "Image" ILIKE '%\\mshta.exe' OR "Image" ILIKE '%\\certutil.exe' OR
    "Image" ILIKE '%\\wscript.exe' OR "Image" ILIKE '%\\cscript.exe' OR
    "Image" ILIKE '%\\regsvr32.exe' OR "Image" ILIKE '%\\msbuild.exe' OR
    "Image" ILIKE '%\\psexec.exe' OR "Image" ILIKE '%\\psexesvc.exe' OR
    "Image" ILIKE '%\\bitsadmin.exe' OR "Image" ILIKE '%\\wmic.exe'
  )
LAST 24 HOURS
ORDER BY EventTime DESC

_sourceCategory=*windows*sysmon* EventCode=1
| where OriginalFileName in ("Cmd.Exe","PowerShell.EXE","pwsh.dll","RUNDLL32.EXE","MSHTA.EXE","CertUtil.exe","wscript.exe","cscript.exe","REGSVR32.EXE","MSBuild.exe","PsExec.exe","bitsadmin.exe","wmic.exe")
| parse regex field=Image "(?<CurrentName>[^\\]+)$" nodrop
| where toLowerCase(CurrentName) != toLowerCase(OriginalFileName)
| table _time, host, User, Image, OriginalFileName, CurrentName, CommandLine, ParentImage, ParentCommandLine, Hashes
| sort by _time desc

rule renamed_legitimate_utilities_t1036_003 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects renamed legitimate Windows system utilities via PE OriginalFileName vs actual process filename mismatch"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1036.003"
    severity = "HIGH"
    confidence = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.target.process.file.pe_file.original_file_name,
      `(?i)^(cmd\.exe|powershell\.exe|pwsh\.exe|rundll32\.exe|mshta\.exe|certutil\.exe|wscript\.exe|cscript\.exe|regsvr32\.exe|msbuild\.exe|psexec\.exe|psexesvc\.exe|bitsadmin\.exe|wmic\.exe)$`)
    not re.regex($e.target.process.file.names,
      `(?i)^(cmd\.exe|powershell\.exe|pwsh\.exe|rundll32\.exe|mshta\.exe|certutil\.exe|wscript\.exe|cscript\.exe|regsvr32\.exe|msbuild\.exe|psexec\.exe|psexesvc\.exe|bitsadmin\.exe|wmic\.exe)$`)

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| OriginalFilename=/(?i)^(cmd\.exe|powershell\.exe|pwsh\.exe|rundll32\.exe|mshta\.exe|certutil\.exe|wscript\.exe|cscript\.exe|regsvr32\.exe|msbuild\.exe|psexec\.exe|psexesvc\.exe|bitsadmin\.exe|wmic\.exe)$/
| LowerFileName := lower(FileName)
| !in(field=LowerFileName, values=["cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "mshta.exe", "certutil.exe", "wscript.exe", "cscript.exe", "regsvr32.exe", "msbuild.exe", "psexec.exe", "psexesvc.exe", "bitsadmin.exe", "wmic.exe"])
| table([_time, ComputerName, UserName, FileName, OriginalFilename, CommandLine, ParentBaseFileName, SHA256HashData])
| sort(field=_time, order=desc)