Gotchas

Where OriginalFilename detections break, measured on 1,043 binaries.

1. Explorer and PowerShell show you the wrong value

The file Properties dialog, (Get-Item x).VersionInfo and .NET FileVersionInfo load the localized MUI copy of the version resource. Sysmon and EDR sensors read the binary's own resource. If you copy the value from Explorer into a rule, the rule never fires.

Every value in this library comes from parsing RT_VERSION straight out of the PE bytes, never from those APIs.

2. Some executables report a DLL name

An .exe process can log an OriginalFilename ending in .dll. One cause is the .NET (Core) apphost: a small native launcher, name.exe, that loads name.dll and carries a copy of the DLL's version resource, so pwsh.exe logs pwsh.dll. Most of the others are ordinary native Windows binaries whose version resource simply names a DLL, such as w32tm.exe →w32time.dll. Either way, a rule that expects an .exe value misses them.

• bdeuisrv.exe → BDEUISRV.DLL
• cleanmgr.exe → CLEANMGR.DLL
• copilotapphost.exe → copilotapphost.dll
• dplaysvr.exe → wcodstub.dll
• dpnsvr.exe → wcodstub.dll
• la57setup.exe → la57setup.dll
• mfpmp.exe → mf.dll
• msinfo32.exe → msinfo.dll
• pwsh.exe → pwsh.dll (.NET apphost)
• rdcman-x86.exe → RDCMan-x86.dll
• rdcman.exe → RDCMan.dll
• unsecapp.exe → unsecapp.dll
• upnpcont.exe → upnpcont.dll
• w32tm.exe → w32time.dll
• wmiadap.exe → wmicookr.dll

3. The value changes between builds

A single value per binary is the common case, but not universal. These 11 binaries changed OriginalFilename, or its casing, between Windows releases or architectures. A rule listing one value silently misses the other builds.

• changepk.exe: OriginalFilename changed across builds: changepk.exe (x64; Win10 1511 → Win11 26H1); changepkey.exe (x64; Win10 1507). Match every value.
• configsecuritypolicy.exe: OriginalFilename changed across builds: ConfigSecurityPolicy.exe (x64; Win10 1703 → Win10 1909); ConfiguSecurityPolicy.exe (x64; Win10 1507 → Win10 1607). Match every value.
• mavinject.exe: OriginalFilename changed across builds: mavinject32.exe (x86; Win10 1607 → Win11 26H1); mavinject64.exe (x64; Win10 1607 → Win11 26H1). Match every value.
• nltest.exe: OriginalFilename changed across builds: nltestrk.exe (x64, x86; Win10 1507 → Win11 25H2); nltest.exe (x64, x86; Win11 26H1). Match every value.
• pnputil.exe: Casing differs across builds (PnPutil.exe, pnputil.exe). Case-sensitive comparisons (Elastic KQL on keyword fields, == in KQL/EQL) miss some builds.
• schtasks.exe: OriginalFilename changed across builds: schtasks.exe (x64, x86; Win10 1809 → Win11 26H1); sctasks.exe (x64, x86; Win10 1511 → Win10 1607). Match every value.
• setup.exe: OriginalFilename changed across builds: SETUP.EXE (x64; Win10 1507 → Win11 26H1); isetup.exe (x86; v10.0.26100.9549). Match every value.
• setupapi.dll: Casing differs across builds (SETUPAPI.DLL, setupapi.dll). Case-sensitive comparisons (Elastic KQL on keyword fields, == in KQL/EQL) miss some builds.
• shell32.dll: Casing differs across builds (SHELL32.DLL, shell32.dll). Case-sensitive comparisons (Elastic KQL on keyword fields, == in KQL/EQL) miss some builds.
• syncappvpublishingserver.exe: Casing differs across builds (SyncAppvPublishingServer.exe, syncappvpublishingserver.exe). Case-sensitive comparisons (Elastic KQL on keyword fields, == in KQL/EQL) miss some builds.
• taskmgr.exe: Casing differs across builds (Taskmgr.exe, taskmgr.exe). Case-sensitive comparisons (Elastic KQL on keyword fields, == in KQL/EQL) miss some builds.

4. Some binaries have no OriginalFilename at all

Either the version resource is missing, or it has no OriginalFilename key, or the key is empty (pcalua.exe). Sysmon logs - for all three. OriginalFileName rules can't see these binaries; use the image path, hash or signer.

• aitstatic.exe
• amd-smi.exe
• amdlogum.exe
• anydesk.exe
• appinstallerbackgroundupdate.exe
• atieah32.exe
• atieah64.exe
• bfscfg.exe
• clinfo.exe
• ctacworker.exe
• deploymentcsphelper.exe
• dgtrayicon.exe
• edit.exe
• eeurestart.exe
• esimtool.exe
• facefoduninstaller.exe
• isolationproxy.exe
• ldmdump.exe
• microsoft.data.usageandqualityinsights.maintenancetask.exe
• miracastpowermanager.exe
• narratormathhost.exe
• nvdebugdump.exe
• nvidia-pcc.exe
• nvidia-smi.exe
• pcalua.exe
• reghide.exe
• rootkitrevealer.exe
• sbupdateworker.exe
• scp.exe
• sftp.exe
• ssh-add.exe
• ssh-agent.exe
• ssh-keygen.exe
• ssh-keyscan.exe
• ssh-pkcs11-helper.exe
• ssh-shellhost.exe
• ssh-sk-helper.exe
• ssh.exe
• sudo.exe
• sysmon64.exe
• ucconfigtask.exe
• vulkaninfo-1-999-0-0-0.exe
• vulkaninfo.exe
• wampluginhost.exe
• wdagnetdiag.exe
• wincsflags.exe

5. The value often isn't the file name

178 binaries carry an OriginalFilename that differs from their file name (ignoring case), so OriginalFileName: <file name> never matches. Most-referenced in Sigma first:

The library's "Differs from file name" filter shows the full list.

6. Case sensitivity depends on the backend

The snippets on every page use the case-insensitive form, and exports are lowercased where they feed lookups.

7. OriginalFilename is attacker-controlled

It survives renaming, which is why it's useful, but it's just a string in a resource section. Anyone can set it on their own tool, or edit it on a copied binary. Easier still, they can strip the version resource and leave nothing to match: the process then logs -, exactly like the 46 binaries above that simply ship without one. Spoofing a value is the loud option; removing it is the quiet one.

Editing a signed binary breaks its signature: Authenticode hashes the resources, and catalog-signed Windows files stop matching their catalog hash. So pair OriginalFileName with signature status and signer — and know which half is doing the work. A renamed but unmodified signed binary keeps a valid signature and its real signer, so only OriginalFileName catches it; a forged value breaks the signature, so only the signature catches that. Each check covers the other's blind spot.

Neither sensor hands you both in one record. Sysmon's process creation event (ID 1) carries no signature fields at all — signature data is on driver load (6) and image load (7). Defender XDR's DeviceProcessEvents gives you ProcessVersionInfoOriginalFileName for the created process, but its signature columns, InitiatingProcessSignatureStatus and InitiatingProcessSignerType, describe the initiating process; for the created one, join SHA1 to DeviceFileCertificateInfo.

8. One file name, different binaries

Generic names like setup.exe cover unrelated binaries that happen to share a name. Check the path and signer before trusting a lookup on the name alone.

9. Sigma literals this database can't vouch for

SigmaHQ (r2026-07-01) rules match 74 OriginalFileName literals that no binary here is named and no parsed build carries. Each one is either a binary this library hasn't collected yet (DLLs loaded by image_load rules, third-party tools) — or a rule arm that can never fire. Until the binary is parsed, the value is an unverified claim.

• Msxsl.exe (3 rules)
• IEExec.exe (2 rules)
• javaw.exe (2 rules)
• psexesvc.exe (2 rules)
• 3CXDesktopApp.exe (1 rule)
• 7z.exe (1 rule)
• 7za.exe (1 rule)
• 7zr.exe (1 rule)
• AdFind.exe (1 rule)
• AdvancedRun.exe (1 rule)
• Akagi.exe (1 rule)
• Akagi64.exe (1 rule)
• AutoHotkey.exe (1 rule)
• AutoHotkey.rc (1 rule)
• AutoIt.exe (1 rule)
• AutoIt2.exe (1 rule)
• AutoIt3.exe (1 rule)
• BOINC.exe (1 rule)
• client32.exe (1 rule)
• credui.dll (1 rule)
• csi.exe (1 rule)
• CtxInstall (1 rule)
• Excel.exe (1 rule)
• foxprow.exe (1 rule)
• FX_VER_INTERNALNAME_STR (1 rule)
• gpg.exe (1 rule)
• jli.dll (1 rule)
• megasync.exe (1 rule)
• meshagent (1 rule)
• Microsoft Access (1 rule)
• Microsoft Excel (1 rule)
• Microsoft OneNote (1 rule)
• Microsoft Outlook (1 rule)
• Microsoft PowerPoint (1 rule)
• Microsoft Publisher (1 rule)
• Microsoft Word (1 rule)
• Microsoft.NodejsTools.PressAnyKey.exe (1 rule)
• Microsoft.WSMan.Management.dll (1 rule)
• MSACCESS.EXE (1 rule)
• MSPUB.EXE (1 rule)
• msteams.exe (1 rule)
• NirCmd.exe (1 rule)
• OneNote.exe (1 rule)
• OneNoteM.exe (1 rule)
• OUTLOOK.EXE (1 rule)
• PAExec.exe (1 rule)
• PCHunter.exe (1 rule)
• PCICFGUI.EXE (1 rule)
• PDQDeployConsole.exe (1 rule)
• PingCastle.exe (1 rule)
• PingCastleCloud.exe (1 rule)
• PingCastleReporting.exe (1 rule)
• Plink (1 rule)
• POWERPNT.EXE (1 rule)
• python.exe (1 rule)
• Radmin.exe (1 rule)
• RstrtMgr.dll (1 rule)
• schdplus.exe (1 rule)
• Sent to OneNote Tool (1 rule)
• SharpLdapWhoami (1 rule)
• SharpView.exe (1 rule)
• System.Management.Automation.dll (1 rule)
• teams.exe (1 rule)
• TruffleSnout.exe (1 rule)
• UltraViewer_Desktop.exe (1 rule)
• VNCViewer.exe (1 rule)
• wincredui.dll (1 rule)
• winPEAS.exe (1 rule)
• winproj.exe (1 rule)
• WinRAR.exe (1 rule)
• WinWord.exe (1 rule)
• WSMANAUTOMATION.DLL (1 rule)
• WsmSvc.dll (1 rule)
• WsmWmiPl.dll (1 rule)