From d207154de3bba3b91e4cbef1ef57433449ee6018 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 22 Jul 2021 06:19:55 -0600
Subject: [PATCH 1/2] Update detect_renamed_winrar.yml

Resolving #1524. Thank you!
---
 detections/endpoint/detect_renamed_winrar.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml
index 74fa6a310b..1b6ffa8a61 100644
--- a/detections/endpoint/detect_renamed_winrar.yml
+++ b/detections/endpoint/detect_renamed_winrar.yml
@@ -12,7 +12,7 @@ description: The following analtyic identifies renamed instances of `WinRAR.exe`
   In this instance, we are using `OriginalFileName` from Sysmon to determine if the
   process is WinRAR. During triage, validate additional metadata from the binary that
   this is `WinRAR`. Review parallel processes and file modifications.
-search: '`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe
+search: '`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe process_name!=winrar.exe
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
   parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
   | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`

From 9acd9f32f73133e66d550373cfe823ad9f7fc605 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 22 Jul 2021 06:20:47 -0600
Subject: [PATCH 2/2] Update detect_renamed_psexec.yml

Resolving #1525 . Thank you!
---
 detections/endpoint/detect_renamed_psexec.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index 90c383d83f..104d0f7647 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -12,7 +12,7 @@ description: The following analytic identifies renamed instances of `PsExec.exe`
   In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec`
   usage. During triage, validate this is the legitimate version of `PsExec` by review
   the PE metadata. In addition, review parallel processes for further suspicious behavior.
-search: '`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe) |
+search: '`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe process_name!=PsExec64.exe) |
   stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name,
   process_name, OriginalFileName, process_path, CommandLine Product | rename Computer
   as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`