Running executables with same hash and different names
Hypothesis and description
Executables are generally not renamed, thus a given hash of an executable should only have ever one name. Identifying instances where multiple process names share the same hash may find cases where tools are copied by attackers to different folders or hosts to avoid detection.
Although this analytic was initially based on MD5 hashes, it is equally applicable to any hashing convention.
### Output Description
A list of hashes and the different executables associated with each one
- Platforms
- Windows, Linux, macOS
- Domain
- Host
- Subtypes
- Process
- Submitted
- 2013-05-23
- Contributors
- MITRE
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1036 MasqueradingT1036.003 | Stealth (formerly Defense Evasion) | Moderate |
1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
D3FEND techniques MITRE maps to this analytic
Data model references
Fields from the CAR data model (object/action/field) the analytic reads.
Pseudocode and implementations
This is a basic Splunk search that will output all of the sysmon-reported process images and their respective hashes, for cases where an image has more than one set of hashes. Thus, this will output a large amount of data and should be filtered by the analyst in order to make the results more useful.
index=__your_sysmon_index__ EventCode=1|stats dc(Hashes) as Num_Hashes values(Hashes) as "Hashes" by Image|where Num_Hashes > 1Sigma includes a Sysmon-specific rule for detecting this, using the OriginalFilename field.
MITRE published no code for this implementation.
Sigma includes a rule specifically for detecting instances of Powershell being renamed.
MITRE published no code for this implementation.
Sigma includes a rule specifically for detecting instances of paexec being renamed.
MITRE published no code for this implementation.
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 group count_unique $App, $HashMD5 limit 100
>>_agg count_unique $HashMD5
>>_checkif int_compare count_unique > 1 includeLogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1
| chart distinct_count(hash) as cnt by image
| search cnt > 1Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-SJAScheduled Job Analysis1 shared
- D3-SFASystem File Analysis1 shared
- D3-DADynamic Analysis1 shared
- D3-EFAEmulated File Analysis1 shared
- D3-SCASystem Call Analysis1 shared
- D3-EALExecutable Allowlisting1 shared
- D3-EDLExecutable Denylisting1 shared
- D3-SCFSystem Call Filtering1 shared
- D3-CFContent Filtering1 shared
- D3-CMContent Modification1 shared
- D3-DFDecoy File1 shared
- D3-FAFile Analysis1 shared