T1036.003: Rename System Utilities
| View on MITRE ATT&CK | T1036.003 |
|---|---|
| Tactic(s) | Defense Evasion |
| Associated CAPEC Patterns | File Manipulation (CAPEC-165) |
Data from MITRE ATT&CK®:
Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. (Citation: LOLBAS Main Site) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). (Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths. (Citation: F-Secure CozyDuke)
© 2024 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Cyber Threat Graph Context
Explore how this ATT&CK Technique relates to the wider threat graph
Mitigations for this technique
MITRE ATT&CK Mitigations
How to detect this technique
MITRE ATT&CK Data Components
File Modification (File)
Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)File Metadata (File)
Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/owner, permissions, etc.Command Execution (Command)
The execution of a line of text, potentially with arguments, created from program code (e.g. a cmdlet executed via powershell.exe, interactive commands like >dir, shell executions, etc. )Process Metadata (Process)
Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.Control Validation Tests for this Technique
Use Atomic Red Team tests to test your defenses against this technique.
Masquerading - cscript.exe running as notepad.exe
Masquerading - powershell.exe running as taskhostw.exe
Masquerading as FreeBSD or Linux crond process.
Masquerading - windows exe running as different windows exe
Masquerading - non-windows exe running as windows exe
Malicious process Masquerading as LSM.exe
Masquerading as Windows LSASS process
Masquerading - wscript.exe running as svchost.exe
File Extension Masquerading
Sigma Detections for this Technique
File With Suspicious Extension Downloaded Via Bitsadmin
Potential Homoglyph Attack Using Lookalike Characters
LOL-Binary Copied From System Directory
Suspicious Copy From or To System Directory
Potential Defense Evasion Via Rename Of Highly Relevant Binaries
PUA - Potential PE Metadata Tamper Using Rcedit
Suspicious Start-Process PassThru
File Download Via Bitsadmin To An Uncommon Target Folder
Suspicious Download From Direct IP Via Bitsadmin
Renamed Jusched.EXE Execution
File Download Via Bitsadmin To A Suspicious Target Folder
Potential Homoglyph Attack Using Lookalike Characters in Filename
Potential Defense Evasion Via Binary Rename
Renamed ProcDump Execution
Potential WerFault ReflectDebugger Registry Value Abuse
Renamed BrowserCore.EXE Execution
File Download Via Bitsadmin
Renamed Msdt.EXE Execution
Potential PendingFileRenameOperations Tamper
Windows Processes Suspicious Parent Directory
Masquerading as Linux Crond Process
Suspicious Download From File-Sharing Website Via Bitsadmin
SP800-53 Controls
See which controls can help protect against this MITRE ATT&CK technique. This is based on mappings to associated SP800-53 controls produced by the MITRE Engenuity Center for Threat-Informed Defense.