How this is built

Detection rules key on OriginalFileName because it survives renaming. Finding the right value is harder than it should be: LOLBAS doesn't record it, and the usual ways of looking it up return the wrong string. This library records the value the way sensors see it, and shows its work.

Where the values come from

1. Raw PE parsing. Every value is read from the RT_VERSION resource inside the binary, using pefile. Windows' own version APIs are never used, because they return the localized MUI value (see gotcha 1).
2. Windows built-ins, every build. Winbindex lists each known build of a Windows file. Each one is downloaded from the Microsoft symbol server and keeps it only if its SHA256 matches Winbindex: the server's timestamp/size key collides often and can return a different build than the one requested.
3. Sysinternals come from live.sysinternals.com; vendor tools from the vendor's own download.
4. Sensor ground truth. A disposable Windows Sandbox installs Sysmon, then creates every target process suspended and kills it before its first instruction runs. Sysmon still logs the process-creation event, so each binary's logged OriginalFileName is compared with the parsed value, matched by exact SHA256, without executing anything.

Provenance

Sysmon-confirmed

A live Sysmon event for this exact build (same SHA256) logged this value.

Parsed

Read from the binary's version resource; no live event for that build yet (other Windows releases, DLLs).

Values other projects publish (LOLRMM's PEMetadata, Sigma rule literals) are only used as cross-checks, never as data. Where they disagree with the binary, the page says so.

Coverage

1,043 binaries and 5,818 parsed builds; 879 binaries confirmed against Sysmon15.22, with zero mismatches. Defender and Elastic values aren't sensor-checked yet. Of 1,276 target names gathered from LOLBAS, LOLRMM, Sysinternals and SigmaHQ (r2026-07-01), 501 are covered so far. Third-party tools and RMM agents are next.

Credits

Built on LOLBAS, LOLRMM,Winbindex, SigmaHQ,Sysinternalsand pefile.

Contributing

The most valuable contribution is sensor evidence: if your Sysmon, Defender or Elastic data shows a different OriginalFilename for a binary, open an issue with its SHA256 and the logged value. Missing binaries and context notes (data/curated/<name>.yml) are welcome too. See CONTRIBUTING.md.