Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Renamed BOINC Client Execution

Detects the execution of a renamed BOINC binary.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Matt Anderson (Huntress)Created Tue Jul 2330d07da2-83ab-45d8-ae75-ec7c0edcaffcwindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic2 selectors
detection:
    selection:
        OriginalFileName: 'BOINC.exe'
    filter_main_legit_name:
        Image|endswith: '\BOINC.exe'
    condition: selection and not 1 of filter_main_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
boinc.berkeley.edu
2
Resolving title…
virustotal.com
3
Resolving title…
huntress.com
MITRE ATT&CK
Rule Metadata
Rule ID
30d07da2-83ab-45d8-ae75-ec7c0edcaffc
Status
test
Level
medium
Type
Detection
Created
Tue Jul 23
Author
Matt Anderson (Huntress)
Path
rules/windows/process_creation/proc_creation_win_renamed_boinc.yml
Raw Tags
attack.defense-evasionattack.t1553
View on GitHub