Replace.exe Usage
Detects the use of Replace.exe which can be used to replace file with another file
Sigma rule (View on GitHub)
1title: Replace.exe Usage
2id: 9292293b-8496-4715-9db6-37028dcda4b3
3status: test
4description: Detects the use of Replace.exe which can be used to replace file with another file
5references:
6 - https://lolbas-project.github.io/lolbas/Binaries/Replace/
7 - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/replace
8author: frack113
9date: 2022/03/06
10modified: 2024/03/13
11tags:
12 - attack.command_and_control
13 - attack.t1105
14logsource:
15 category: process_creation
16 product: windows
17detection:
18 selection:
19 Image|endswith: '\replace.exe'
20 argument:
21 CommandLine|contains|windash: '-a'
22 condition: selection and argument
23falsepositives:
24 - Unknown
25level: medium
References
Related rules
- Uncommon Network Connection Initiated By Certutil.EXE
- Lolbas OneDriveStandaloneUpdater.exe Proxy Download
- Potential In-Memory Download And Compile Of Payloads
- File Download Via Nscurl - MacOS
- Local Network Connection Initiated By Script Interpreter