T1036.003 Rename Legitimate Utilities — ATT&CK Technique
Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython. It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.
Detection coverage (37)
- Masquerading as Linux Crond Process medium
- Remote Access Tool - Renamed MeshAgent Execution - Windows high
- Remote Access Tool - Renamed MeshAgent Execution - MacOS high
- PUA - Potential PE Metadata Tamper Using Rcedit medium
- Renamed BrowserCore.EXE Execution high
- Potential Homoglyph Attack Using Lookalike Characters in Filename medium
- Renamed Powershell Under Powershell Channel low
- Suspicious Start-Process PassThru medium
- Suspicious Download From Direct IP Via Bitsadmin high
- Suspicious Download From File-Sharing Website Via Bitsadmin high
- File Download Via Bitsadmin To A Suspicious Target Folder high
- File Download Via Bitsadmin medium
- File With Suspicious Extension Downloaded Via Bitsadmin high
- Renamed Msdt.EXE Execution high
- Potential Defense Evasion Via Rename Of Highly Relevant Binaries high
- Potential Defense Evasion Via Binary Rename medium
- Renamed Jusched.EXE Execution high
- Renamed Office Binary Execution high
- Renamed Schtasks Execution high
- Renamed ProcDump Execution high
- LOL-Binary Copied From System Directory high
- Suspicious Copy From or To System Directory medium
- Potential Homoglyph Attack Using Lookalike Characters medium
- Windows Processes Suspicious Parent Directory low
- Potential WerFault ReflectDebugger Registry Value Abuse high
- Potential PendingFileRenameOperations Tampering medium
- Execution of File with Multiple Extensions
- Suspicious Copy on System32
- Suspicious microsoft workflow compiler rename
- Suspicious msbuild path
- Suspicious MSBuild Rename
- System Processes Run From Unexpected Locations
- Windows DotNet Binary in Non Standard Path
- Windows InstallUtil in Non Standard Path
- Windows LOLBAS Executed As Renamed File
- Windows Renamed Powershell Execution
- Ps.exe Renamed SysInternals Tool high