Renamed, Unsigned or Falsely Signed Binaries

Red Flags

Windows' own programs carry version information, including the original file name they were built with. Microsoft signs its files, many through a catalogue, a signed file that lists their hashes, rather than inside the file. Windows does not run its own tools under other names, though a few of its files carry a different original name by design. A known tool under a new name is usually there to slip past rules that read names alone, and an unsigned binary posing as part of Windows has nobody vouching for it. Compare the running name with the original file name first, then check the signature with a tool that reads catalogues.

Normal and Suspicious

A clean machine sits beside a suspicious one, and the pointer marks where to look.

Normal

A clean Windows 11 install

The console host on a clean install. Velociraptor notes conhost.exe can show as unsigned, so check it with a tool that reads catalogues.
NamePath
conhost.exeC:\Windows\System32\conhost.exe
See It in the Window

Suspicious

ws-042,

The service binary on ws-042 at 10:06 on 12 Oct 2026, with no version information. Its service's display name is Windows Update Helper.
NamePathSigned By
updsvc64.exeC:\Windows\Temp\updsvc64.exeNot signed
Signed ByNot signed, behind a service named Windows Update Helper: Windows' own binaries are signed by Microsoft. Renamed, Unsigned or Falsely Signed Binaries
See It in the Window

Why It Matters

Rules that read only a file's name miss a renamed copy, and an unsigned binary posing as part of Windows has nobody vouching for it. The file's version information and signature give both away.

How to Confirm It

Work through these in order. Each step names the page that shows how.

  1. Compare the image name with the original file name in its version information, in Sysmon's OriginalFileName or Defender's ProcessVersionInfoOriginalFileName. A mismatch is a renamed copy.Process Listings and Scans
  2. Check the signature with a tool that reads catalogues, such as Get-AuthenticodeSignature or Sigcheck, so Windows' catalogue-signed files are not taken for unsigned ones.Process Listings and Scans
  3. Never let a signature clear a file on its own. Check the signer is the one the program should have, and that the certificate is still trusted.Process Listings and Scans
  4. Take the file from disk, or from memory if it is gone, and check its hash, version information and signer offline. A copy from memory may not hash like the file.Dumping a Process and Memory
  5. For a service or a task, read its name against its binary and signer. A Windows-sounding name on an unsigned binary in Temp is a disguise.Process Listings and Scans

What Defenders See

Each record names its log and what must be switched on to get it.

Record and Where It LandsWhat to ReadHow to Turn It On
1 Process creation (opens in a new tab)Microsoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon.OriginalFileName beside Image, because the name in the version information survives a rename.Process Trees and Call Chains shows how to read it.Run Sysmon with ProcessCreate events in its configuration.
DeviceProcessEvents (opens in a new tab)Each row is a process creation or a related event, naming the new process, the process that created it and that creator's parent.Defender XDR, advanced huntingProcessVersionInfoOriginalFileName beside FileName. Signing needs a join on SHA1 with DeviceFileCertificateInfo.The Defender for Endpoint sensor on the device
DeviceFileCertificateInfo (opens in a new tab)Each row is the signing certificate of a file seen on devices. It says whether the signature is embedded or comes from a catalogue file, and whether it is trusted.Defender XDR, advanced huntingIsSigned, IsTrusted, Signer and SignatureType, embedded or from a catalogue, for each file by its SHA1.The Defender for Endpoint sensor on the device
7045 New Service Installed (opens in a new tab)SystemThe Service Control Manager writes it on the computer the service was installed on.The service name beside its binary. A name that sounds like part of Windows on an unsigned binary in Temp is a disguise.On by default

What It Looks Like

This record is decoded field by field, with what each value means.

1 Process creation (opens in a new tab)On srv-app-01, . An illustration of Sysmon event 1 on srv-app-01, the web application server, on 20 Oct 2026.
Field, as the Record Writes ItWhat It Tells You
ImageC:\ProgramData\svcmon.exeThe program as it ran, under a name no Windows file uses. On its own the name says nothing about what the file is.
OriginalFileNameCmd.ExeThe name compiled into the file, which shows this is the Windows command prompt under another name. Rules that read only the name miss it, and this field catches it.
ParentImageC:\Windows\System32\inetsrv\w3wp.exeStarted by the IIS worker process that serves the web application. A web server starting a shell is a red flag of its own.
False Positives

Many Windows files are signed through a catalogue rather than inside the file, and Velociraptor's own note warns that genuine files such as conhost.exe can show as unsigned, so check with a tool that reads catalogues.

A few Windows files carry a different original name by design, such as nbtstat.exe, whose version information says nbtinfo.exe.

Blind Spots

A stolen or bought certificate makes malware validly signed, so the signer's name, the file's age and how rare it is matter more than the signature itself.

A file with no version information has no original name to compare, so the rename checks pass it. updsvc64.exe needs the signature and path checks.

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

Sees It DirectlyDeviceProcessEvents with DeviceFileCertificateInfo (documentation, opens in a new tab)

Needs Defender for Endpoint. DeviceProcessEvents' signature columns describe the creator, so the file's signature comes from DeviceFileCertificateInfo by SHA1. A service with no row there may only be unchecked, so confirm it on the machine.

KQLDefender XDR, Advanced hunting
// Windows and admin tools running under another name, and service binaries that are unsigned, untrusted or have no certificate recordlet renamed = DeviceProcessEvents    | where Timestamp > ago(30d)    | extend Original = trim_end(@"\.mui", tolower(ProcessVersionInfoOriginalFileName))    | where Original in ("cmd.exe", "powershell.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe", "certutil.exe", "cscript.exe", "wscript.exe", "msiexec.exe", "reg.exe", "net.exe", "netsh.exe", "psexec.c", "psexesvc.exe")    | where tolower(FileName) != Original    | extend Finding = "Renamed";let certs = DeviceFileCertificateInfo    | where Timestamp > ago(30d)    | summarize arg_max(Timestamp, IsSigned, IsTrusted) by SHA1    | project SHA1, IsSigned, IsTrusted;let serviceBinaries = DeviceProcessEvents    | where Timestamp > ago(30d)    | where InitiatingProcessFileName =~ "services.exe" and isnotempty(SHA1)    | join kind=leftouter certs on SHA1    | where isnull(IsSigned) or not(IsSigned) or not(IsTrusted)    | extend Finding = iff(isnull(IsSigned), "Service with no certificate record", "Unsigned or untrusted service");union renamed, serviceBinaries| project Timestamp, DeviceName, Finding, FileName, FolderPath, ProcessVersionInfoOriginalFileName, InitiatingProcessFileName, AccountName, ProcessCommandLine| order by Timestamp desc

In a Memory Image

Volatility 3 reads a memory image, and each of its plugins below shows part of this sign.

  • windows.verinfo (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. The version numbers in each mapped image, set against the build. It does not print the original file name, so read that from an extracted copy.
  • windows.dumpfiles (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. The files cached in memory behind a process, its image among them, for an offline look. A copy rebuilt from memory may not match the file on disk.
  • windows.pslist (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. pslist means process list. With its dump option, the process image as mapped in memory, which will not match the file byte for byte.

Rules to Compare With

Security vendors publish detection rules anyone can read. These look for the same thing, so compare your own with them.

Show the 3 Public Rules

How to Prevent It

Each control helps prevent it, and its line says what it does here.

Related

Where It Matters Most
  • services.exe A child service binary that is unsigned, or named to pass as part of Windows.
  • LsaIso.exe A file that fails its signature check, since a genuine copy is signed with a certificate VBS trusts.
  • LogonUI.exe A LogonUI.exe with no valid signature, embedded or through a catalogue.
  • dwm.exe A dwm.exe with no valid signature, embedded or through a catalogue.
See Them in the Tree
Travels with
Check It in the Registry
Sysinternals EulaAcceptedAmcache

Sources

MITRE ATT&CK is a free public catalogue of the techniques attackers use. Each technique has an ID, such as T1055 for Process Injection, so defenders can name the same behaviour the same way. This red flag can point to these techniques.