tfMITRE ATT&CK sub-technique

Rename Legitimate Utilities T1036.003

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 3.0
Created: 10 February 2020
Last modified: 12 May 2026
Contributor: Matt Anderson, @‌nosecurething, Huntress

Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.[1][2][3][4] It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe).[5] An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.[6]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 25%

Threat groups75th percentile · 75% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware66th pct

Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 6%

Detection rules94th percentile · 94% of ATT&CK techniques have this many detection rules written or fewer.

Rename Legitimate Utilities MITRE reference T1036.003

Top 25%of all ATT&CK techniques for number of groups

6 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

DaggerflyG1034 ↗

Used a renamed version of rundll32.exe, such as "dbengin.exe" located in the ProgramData\Microsoft\PlayReady directory, to proxy malicious DLL execution.1

created 2024-07-251 referenceaka Evasive Panda

GALLIUMG0093 ↗

Used a renamed cmd.exe file to evade detection.1

created 2019-07-181 referenceaka Granite Typhoon

APT38G0082 ↗

Has renamed system utilities, such as rundll32.exe and mshta.exe, to avoid detection.1

created 2019-01-291 referenceaka NICKEL GLADSTONE

APT32G0050 ↗

Has moved and renamed pubprn.vbs to a .txt file to avoid detection.1

created 2017-12-141 referenceaka SeaLotus

menuPassG0045 ↗

Has renamed certutil and moved it to a different location on the system to avoid detection based on use of the tool.1

created 2017-05-311 referenceaka Cicada

Lazarus GroupG0032 ↗

Has renamed system utilities such as wscript.exe and mshta.exe.1

created 2017-05-311 referenceaka Labyrinth Chollima

All 6 groups for this technique

5 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

PHASEJAMS9014 ↗

Has renamed the file /home/bin/remotedebug to remotedebug.bak, allowing the threats actors to write a malicious /home/bin/remotedebug shell script.1

created 2026-04-16MALWARE

StrelaStealerS1183 ↗

Has used a renamed, legitimate msinfo32.exe executable to sideload the StrelaStealer payload during initial installation.1

created 2024-12-31MALWARE

DarkGateS1111 ↗

Executes a Windows Batch script during installation that creases a randomly-named directory in the C:\\ root directory that copies and renames the legitimate Windows <curl>curl</code> command to this new location.1

created 2024-02-09MALWARE

KevinS1020 ↗

Has renamed an image of cmd.exe with a random name followed by a .tmpl extension.1

created 2022-06-14MALWAREcarried by 1 group

CozyCarS0046 ↗

The CozyCar dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file.1

created 2017-05-31MALWAREcarried by 1 group

All 5 software entries for this technique

Offense vs defense T1036.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 27Splunk ESCU (cumulative) · 10

first rule: 2017 Q1

Rename Legitimate Utilities detection strategy DET0005

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Renamed Legitimate Utility Execution with Metadata Mismatch and Suspicious Path

Enterprise

3 platforms

AN0012 · Windows

Execution of binaries where the on-disk filename does not match PE metadata such as OriginalFilename or InternalName. Often observed with renamed LOLBAS or system binaries like rundll32, powershell, or psexec.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Command ExecutionDC0064	EDR:AMSI	None

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ImagePath	Filter by suspicious or non-standard directory paths
PEInternalNameMismatch	Enable tuning based on mismatch rules between metadata and disk filename
CommandLinePattern	Flag unusual or rare argument combinations for LOLBAS-like tools

AN0013 · macOS

Execution of renamed or relocated native macOS utilities with uncommon names or non-default paths (e.g., renamed osascript, bash, or curl).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_EXEC
Process MetadataDC0034	macos:unifiedlog	subsystem=com.apple.process
File ModificationDC0061	fs:fileevents	/var/log/quarantine.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PathDeviation	Path deviation from expected directory (e.g., /usr/bin/ vs /tmp/)
BinaryHashReputation	Enable tuning based on hash matching known signed versions vs suspicious clones
UserRole	Scope detections based on non-admin users using admin-level tools

AN0014 · Linux

Execution of renamed common utilities (e.g., bash, nc, python, sh) from atypical directories or with names intended to deceive defenders or EDRs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File MetadataDC0059	linux:osquery	event-based
Command ExecutionDC0064	linux:syslog	cron activity

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExecutionPath	Path anomalies such as execution from /dev/shm, /tmp, or user home directories
ParentProcessContext	Unusual lineage such as scripts invoking renamed tools
TimeWindow	Correlate between file rename and immediate execution

1 analytic

Executables are generally not renamed, thus a given hash of an executable should only have ever one name. Identifying instances where multiple process names share the same hash may find cases where tools are copied by attackers to different folders or hosts to avoid detection.

TypeTTPCoverageModerateSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-SBV	Service Binary Verification
D3-SFA	System File Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	md5_hash

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This is a basic Splunk search that will output all of the sysmon-reported process images and their respective hashes, for cases where an image has more than one set of hashes. Thus, this will output a large amount of data and should be filtered by the analyst in order to make the results more useful.

index=__your_sysmon_index__ EventCode=1|stats dc(Hashes) as Num_Hashes values(Hashes) as "Hashes" by Image|where Num_Hashes > 1

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 group count_unique $App, $HashMD5 limit 100
>>_agg count_unique $HashMD5
>>_checkif int_compare count_unique > 1 include

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1
| chart distinct_count(hash) as cnt by image
| search cnt > 1

Restrict File and Directory PermissionsM1022

Use file system access controls to protect folders such as C:\Windows\System32.

Tests8Executorscmd 5 · PowerShell 2 · sh 1Need elevation1 of 8Have prerequisites2Have cleanup8Platformswindows, linux

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Masquerading as Windows LSASS process windows cmd — — Yes

Copies cmd.exe, renames it, and launches it to masquerade as an instance of lsass.exe. Upon execution, cmd will be launched by powershell. If using Invoke-AtomicTest, The test will hang until the 120 second timeout cancels the session

Attack command

copy %SystemRoot%\System32\cmd.exe %SystemRoot%\Temp\lsass.exe
%SystemRoot%\Temp\lsass.exe /B

Cleanup command

del /Q /F %SystemRoot%\Temp\lsass.exe >nul 2>&1

GUID8997fc7f-c9ed-4022-ac9c-99afa2287346

02 Masquerading as FreeBSD or Linux crond process. linux sh — — Yes

Copies sh process, renames it as crond, and executes it to masquerade as the cron daemon. Upon successful execution, sh is renamed to crond and executed.

Attack command

cp /bin/sh /tmp/crond;
echo 'sleep 5' | /tmp/crond

Cleanup command

rm /tmp/crond

GUIDb04e0dae-daf6-4e11-99d4-7b65bdcf4bbb

03 Masquerading - cscript.exe running as notepad.exe windows cmd — — Yes

Copies cscript.exe, renames it, and launches it to masquerade as an instance of notepad.exe. Upon successful execution, cscript.exe is renamed as notepad.exe and executed from non-standard path.

Attack command

copy %SystemRoot%\System32\cscript.exe %APPDATA%\notepad.exe /Y
cmd.exe /c %APPDATA%\notepad.exe /B

Cleanup command

del /Q /F %APPDATA%\notepad.exe >nul 2>&1

GUIDb361439a-e978-4af5-8b60-4c17bb90ba14

04 Masquerading - wscript.exe running as svchost.exe windows cmd — 1 Yes

Copies wscript.exe, renames it, and launches it to masquerade as an instance of svchost.exe. Upon execution, no windows will remain open but wscript will have been renamed to svchost and ran out of the temp folder

Attack command

copy %SystemRoot%\System32\wscript.exe %APPDATA%\svchost.exe /Y
cmd.exe /c %APPDATA%\svchost.exe "PathToAtomicsFolder\..\ExternalPayloads\T1036.003\src\T1036.003_masquerading.vbs"

Cleanup command

del /Q /F %APPDATA%\svchost.exe >nul 2>&1

Prerequisite

Wscript file to execute must exist on disk

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\T1036.003\src\T1036.003_masquerading.vbs") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "PathToAtomicsFolder\..\ExternalPayloads\T1036.003\src\T1036.003_masquerading.vbs") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1036.003/src/T1036.003_masquerading.vbs" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\T1036.003\src\T1036.003_masquerading.vbs"

GUID89053aa8-4f00-4a1a-979f-e73feb93f27d

05 Masquerading - powershell.exe running as taskhostw.exe windows cmd — — Yes

Copies powershell.exe, renames it, and launches it to masquerade as an instance of taskhostw.exe. Upon successful execution, powershell.exe is renamed as taskhostw.exe and executed from non-standard path.

Attack command

copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\taskhostw.exe /Y
cmd.exe /K %APPDATA%\taskhostw.exe

Cleanup command

del /Q /F %APPDATA%\taskhostw.exe >nul 2>&1

GUID59dee6c6-b4d4-45f1-8c7a-a68a4a77650c

06 Masquerading - non-windows exe running as windows exe windows PowerShell — 1 Yes

Copies an exe, renames it as a windows exe, and launches it to masquerade as a real windows exe Upon successful execution, powershell will execute T1036.003.exe as svchost.exe from on a non-standard path.

Input arguments

Name	Type	Default	Description
inputfile	path	PathToAtomicsFolder\T1036.003\bin\T1036.003.exe	path of file to copy
outputfile	path	($env:TEMP + "\svchost.exe")	path of file to execute

Attack command

copy "#{inputfile}" #{outputfile}
try { $myT1036_003 = (Start-Process -PassThru -FilePath #{outputfile}).Id }
catch { $_; exit $_.Exception.HResult}
Stop-Process -ID $myT1036_003

Cleanup command

Remove-Item #{outputfile} -Force -ErrorAction Ignore

Prerequisite

Exe file to copy must exist on disk at specified location (#{inputfile})

Check

if (Test-Path "#{inputfile}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{inputfile}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1036.003/bin/T1036.003.exe" -OutFile "#{inputfile}"

GUIDac4a9f38-8a69-4edd-8a5b-36a1e2e527f6

07 Masquerading - windows exe running as different windows exe windows PowerShell — — Yes

Copies a windows exe, renames it as another windows exe, and launches it to masquerade as second windows exe

Input arguments

Name	Type	Default	Description
inputfile	path	$env:ComSpec	path of file to copy
outputfile	path	($env:TEMP + "\svchost.exe")	path of file to execute

Attack command

copy "#{inputfile}" #{outputfile}
$myT1036_003 = (Start-Process -PassThru -FilePath #{outputfile}).Id
Stop-Process -ID $myT1036_003

Cleanup command

Remove-Item #{outputfile} -Force -ErrorAction Ignore

GUID7ea1b13b-0454-40df-856b-eb08ea81fc48

08 Malicious process Masquerading as LSM.exe windows cmd Required — Yes

Detect LSM running from an incorrect directory and an incorrect service account This works by copying cmd.exe to a file, naming it lsm.exe, then copying a file to the C:\ folder. Upon successful execution, cmd.exe will be renamed as lsm.exe and executed from non-standard path.

Attack command

copy C:\Windows\System32\cmd.exe C:\lsm.exe
C:\lsm.exe /c echo T1036.003 > C:\T1036.003.txt

Cleanup command

del C:\T1036.003.txt >nul 2>&1
del C:\lsm.exe >nul 2>&1

GUID4e558dd6-14eb-41a0-a72c-0b08d30f680f

Tests from Atomic Red Team (MIT licence) · technique definition

Rename Legitimate Utilities detections T1036.003

37 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 6%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs