Rename Legitimate Utilities

T1036.003

Sub-technique of T1036 Masquerading.View on attack.mitre.org

About this technique

Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython. It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.

Detection rules39

Rules on DetectionCode tagged with T1036.003.

Sigma27

Rule	Level	Log source
File Download Via Bitsadmin To A Suspicious Target Folder	high	windows / process_creation
File With Suspicious Extension Downloaded Via Bitsadmin	high	windows / process_creation
LOL-Binary Copied From System Directory	high	windows / process_creation
Potential Defense Evasion Via Rename Of Highly Relevant Binaries	high	windows / process_creation
Potential WerFault ReflectDebugger Registry Value Abuse	high	windows / registry_set
Remote Access Tool - Renamed MeshAgent Execution - MacOS	high	macos / process_creation
Remote Access Tool - Renamed MeshAgent Execution - Windows	high	windows / process_creation
Renamed BrowserCore.EXE Execution	high	windows / process_creation
Renamed Jusched.EXE Execution	high	windows / process_creation
Renamed Msdt.EXE Execution	high	windows / process_creation
Renamed Office Binary Execution	high	windows / process_creation
Renamed ProcDump Execution	high	windows / process_creation
Renamed Schtasks Execution	high	windows / process_creation
Suspicious Download From Direct IP Via Bitsadmin	high	windows / process_creation
Suspicious Download From File-Sharing Website Via Bitsadmin	high	windows / process_creation
File Download Via Bitsadmin	medium	windows / process_creation
File Download Via Bitsadmin To An Uncommon Target Folder	medium	windows / process_creation
Masquerading as Linux Crond Process	medium	linux / NULL
Potential Defense Evasion Via Binary Rename	medium	windows / process_creation
Potential Homoglyph Attack Using Lookalike Characters	medium	windows / process_creation
Potential Homoglyph Attack Using Lookalike Characters in Filename	medium	windows / file_event
Potential PendingFileRenameOperations Tampering	medium	windows / registry_set
PUA - Potential PE Metadata Tamper Using Rcedit	medium	windows / process_creation
Suspicious Copy From or To System Directory	medium	windows / process_creation
Suspicious Start-Process PassThru	medium	windows / ps_script
Renamed Powershell Under Powershell Channel	low	windows / ps_classic_start
Windows Processes Suspicious Parent Directory	low	windows / process_creation

Splunk12

Rule	Type	Risk	Data source
Execution of File with Multiple Extensions	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Execution of File With Spaces Before Extension	TTP	NULL	Sysmon EventID 1
Suspicious Copy on System32	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Suspicious microsoft workflow compiler rename	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Suspicious msbuild path	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Suspicious MSBuild Rename	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Suspicious Rundll32 Rename	Hunting	NULL	Sysmon EventID 1
System Processes Run From Unexpected Locations	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows DotNet Binary in Non Standard Path	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows InstallUtil in Non Standard Path	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows LOLBAS Executed As Renamed File	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Renamed Powershell Execution	TTP	NULL	Sysmon EventID 1

Groups6

Software5

CozyCar DarkGate Kevin PHASEJAM StrelaStealer

Campaigns0

None recorded.

Procedure examples11

Groups6

Used by	Procedure example
GroupAPT32	APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection. Twitter ItsReallyNick APT32 pubprn Masquerade
GroupAPT38	APT38 has renamed system utilities, such as `rundll32.exe` and `mshta.exe`, to avoid detection. 1 - appv
GroupDaggerfly	Daggerfly used a renamed version of rundll32.exe, such as "dbengin.exe" located in the `ProgramData\Microsoft\PlayReady` directory, to proxy malicious DLL execution. Symantec Daggerfly 2023
GroupGALLIUM	GALLIUM used a renamed cmd.exe file to evade detection. Cybereason Soft Cell June 2019
GroupLazarus Group	Lazarus Group has renamed system utilities such as `wscript.exe` and `mshta.exe`. Qualys LolZarus
GroupmenuPass	menuPass has renamed certutil and moved it to a different location on the system to avoid detection based on use of the tool. FireEye APT10 Sept 2018

Software5

Used by	Procedure example
MalwareCozyCar	The CozyCar dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file. F-Secure CozyDuke
MalwareDarkGate	DarkGate executes a Windows Batch script during installation that creases a randomly-named directory in the `C:\\` root directory that copies and renames the legitimate Windows <curl>curl</code> command to this new location. Trellix Darkgate 2023
MalwareKevin	Kevin has renamed an image of `cmd.exe` with a random name followed by a `.tmpl` extension. Kaspersky Lyceum October 2021
MalwarePHASEJAM	PHASEJAM has renamed the file `/home/bin/remotedebug` to `remotedebug.bak`, allowing the threats actors to write a malicious `/home/bin/remotedebug` shell script. Google UNC5221 Ivanti January 2025
MalwareStrelaStealer	StrelaStealer has used a renamed, legitimate `msinfo32.exe` executable to sideload the StrelaStealer payload during initial installation. DCSO StrelaStealer 2022

References6

Elastic Masquerade Ball Open source
Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball. Retrieved October 31, 2016.
F-Secure CozyDuke Open source
F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis. Retrieved December 10, 2015.
Huntress Python Malware 2025 Open source
Matthew Brennan. (2024, July 5). Snakes on a Domain: An Analysis of a Python Malware Loader. Retrieved April 3, 2025.
LOLBAS Main Site Open source
LOLBAS. (n.d.). Living Off The Land Binaries and Scripts (and also Libraries). Retrieved February 10, 2020.
Splunk Detect Renamed PSExec Open source
Splunk. (2025, February 24). Detection: Detect Renamed PSExec. Retrieved April 3, 2025.
The DFIR Report AutoHotKey 2023 Open source
The DFIR Report. (2023, February 6). Collect, Exfiltrate, Sleep, Repeat. Retrieved April 3, 2025.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.