Abuse of Replace.exe Living-off-the-Land Binary

The Windows native utility replace.exe is a command-line tool designed to replace files in a directory or across a drive. While intended for administrative maintenance and software updates, threat actors leverage this binary to replace legitimate system or application files with malicious counterparts. This technique falls under the Living-off-the-Land Binaries (LOLBins) classification, as the tool is digitally signed by Microsoft and often overlooked by security controls. When combined with the '-a' argument, which adds files to a destination directory instead of replacing existing ones, or used to overwrite target binaries, attackers can achieve code execution or persistence. Defenders should monitor for unexpected execution of replace.exe, particularly when used with arguments that signify modification of system directories.

Impact

Successful abuse of replace.exe can allow an attacker to gain persistence, escalate privileges by replacing sensitive system binaries, or deploy secondary malware payloads while avoiding detection by traditional file-integrity monitoring tools. This technique is applicable to any Windows environment where the attacker has gained sufficient user permissions to modify target file locations.

Recommendation

Deploy the Sigma rule provided in this brief to detect the execution of replace.exe with specific command-line arguments. Enable Sysmon Process Creation (Event ID 1) logging and baseline administrative usage of replace.exe to reduce false positives in your environment.