MITRE ATT&CKsub-technique

T1036.003 Rename Legitimate Utilities

Published 2020-02-10 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
Linux, macOS, Windows
Version
3.0
Created
2020-02-10

Description

Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython. It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1036 Masquerading technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1022 Restrict File and Directory Permissions mitigation

Referenced by MITRE ATT&CK · uses (11)

  • S9014 PHASEJAM software (malware)
  • S1183 StrelaStealer software (malware)
  • G1034 Daggerfly group
  • S1111 DarkGate software (malware)
  • S1020 Kevin software (malware)
  • G0093 GALLIUM group
  • G0082 APT38 group
  • G0050 APT32 group
  • G0032 Lazarus Group group
  • G0045 menuPass group
  • S0046 CozyCar software (malware)

Referenced by CAPEC · att&ck technique (1)

Referenced by Compliance · mitigates (8)

  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References