Techniques › T1036 › T1036.003
T1036.003 Rename Legitimate Utilities
stealth — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
27
Sigma rules tagged attack.t1036.003
0
KEV CVEs mapped here
<p>Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython. It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename <code>rundll32.exe</code>). An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0005 Renamed Legitimate Utility Execution with Metadata Mismatch and Suspicious Path v1.0
AN0012 WindowsExecution of binaries where the on-disk filename does not match PE metadata such as OriginalFilename or InternalName. Often observed with renamed LOLBAS or system binaries like rundll32, powershell, or psexec.Tunable:
ImagePathPEInternalNameMismatchCommandLinePatternAN0013 macOSExecution of renamed or relocated native macOS utilities with uncommon names or non-default paths (e.g., renamedosascript,bash, orcurl).Tunable:PathDeviationBinaryHashReputationUserRoleAN0014 LinuxExecution of renamed common utilities (e.g.,bash,nc,python,sh) from atypical directories or with names intended to deceive defenders or EDRs.Tunable:ExecutionPathParentProcessContextTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1036.003
Author: frack113
· 2022-01-15 (modified 2026-05-18) · logsource: product=windows category=ps_script · 0718cd72-f316-4aa2-988f-838ea8533277
Powershell use PassThru option to start in background
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-20 (modified 2025-12-09) · logsource: product=windows category=process_creation · 0b0cd537-fc77-4e6e-a973-e53495c1083d
Detects the execution of a renamed office binary
Author: Matthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113
· 2019-06-15 (modified 2026-06-29) · logsource: product=windows category=process_creation · 0ba1da6d-b6ce-4366-828c-18826c9de23e
Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.
Author: Micah Babinski
· 2022-12-11 (modified 2023-03-05) · logsource: product=windows category=process_creation · 0c92f2e6-f08f-4b73-9216-ecb0ca634689
Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.
Author: X__Junior
· 2023-05-18 · logsource: product=windows category=registry_set · 0cf2e1c6-8d10-4273-8059-738778f981ad
Detects potential WerFault "ReflectDebugger" registry value abuse for persistence.
Author: Florian Roth (Nextron Systems)
· 2017-10-22 (modified 2023-05-02) · logsource: product=windows category=process_creation · 18da1007-3f26-470f-875d-f77faf1cab31
Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-06-28 (modified 2025-12-10) · logsource: product=windows category=process_creation · 2ddef153-167b-4e89-86b6-757a9e65dcac
Detects usage of bitsadmin downloading a file to a suspicious target folder
Author: Harish Segar, frack113
· 2020-06-29 (modified 2025-01-20) · logsource: product=windows category=ps_classic_start · 30a8cb77-8eb3-4cfb-8e79-ad457c5a4592
Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.
Author: Micah Babinski, @micahbabinski
· 2023-05-07 · logsource: product=windows category=process_creation · 32e280f1-8ad4-46ef-9e80-910657611fbc
Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.
This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.
Author: Matthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades)
· 2019-06-15 (modified 2026-06-05) · logsource: product=windows category=process_creation · 36480ae1-a1cb-4eaa-a0d6-29801d7e9142
Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2019-11-18 (modified 2026-06-29) · logsource: product=windows category=process_creation · 4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67
Detects the execution of a renamed ProcDump executable.
This often done by attackers or malware in order to evade defensive mechanisms.
Author: frack113
· 2023-01-27 (modified 2025-10-07) · logsource: product=windows category=registry_set · 4eec988f-7bf0-49f1-8675-1e6a510b3a2a
Detect changes to the "PendingFileRenameOperations" registry key from uncommon or suspicious images locations to stage currently used files for rename or deletion after reboot.
Author: Micah Babinski, @micahbabinski
· 2023-05-08 · logsource: product=windows category=file_event · 4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6
Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.
This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-06-28 (modified 2023-05-30) · logsource: product=windows category=process_creation · 5b80a791-ad9b-4b75-bcc1-ad4e1e89c200
Detects usage of bitsadmin downloading a file with a suspicious extension
Author: Florian Roth (Nextron Systems)
· 2022-06-28 (modified 2026-03-29) · logsource: product=windows category=process_creation · 8518ed3d-f7c9-4601-a26c-f361a4256a0c
Detects usage of bitsadmin downloading a file from a suspicious domain
Author: Max Altgelt (Nextron Systems)
· 2022-06-02 (modified 2023-02-03) · logsource: product=windows category=process_creation · 8a4519e8-e64a-40b6-ae85-ba8ad2177559
Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)
Author: vburov
· 2019-02-23 (modified 2025-03-06) · logsource: product=windows category=process_creation · 96036718-71cc-4027-a538-d1587e0006a7
Detect suspicious parent processes of well-known Windows processes
Author: Florian Roth (Nextron Systems)
· 2022-06-28 (modified 2023-02-15) · logsource: product=windows category=process_creation · 99c840f2-2012-46fd-9141-c761987550ef
Detects usage of bitsadmin downloading a file using an URL that contains an IP
Author: Timur Zinniatullin, oscd.community
· 2019-10-21 (modified 2023-08-22) · logsource: product=linux service=auditd · 9d4548fa-bba0-4e88-bd66-5d5bf516cda0
Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.
Several different variations of this technique have been observed.
Author: Norbert Jaśniewicz (AlphaSOC)
· 2025-05-19 · logsource: product=windows category=process_creation · b471f462-eb0d-4832-be35-28d94bdb4780
Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.
RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.
Author: pH-T (Nextron Systems)
· 2022-06-03 (modified 2023-02-03) · logsource: product=windows category=process_creation · bd1c6866-65fc-44b2-be51-5588fcff82b9
Detects the execution of a renamed "Msdt.exe" binary
Author: Norbert Jaśniewicz (AlphaSOC)
· 2025-05-19 · logsource: product=macos category=process_creation · bd3b5eaa-439d-4a42-8f35-a49f5c8a2582
Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.
RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.
Author: Michael Haag, FPT.EagleEye
· 2017-03-09 (modified 2023-02-15) · logsource: product=windows category=process_creation · d059842b-6b9d-4ed1-b5c3-5b89143c6ede
Detects usage of bitsadmin downloading a file
Author: Markus Neis, Swisscom
· 2019-06-04 (modified 2023-02-03) · logsource: product=windows category=process_creation · edd8a48c-1b9f-4ba1-83aa-490338cd1ccb
Detects the execution of a renamed "jusched.exe" as seen used by the cobalt group
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-08-29 (modified 2025-11-27) · logsource: product=windows category=process_creation · f5d19838-41b5-476c-98d8-ba8af4929ee2
Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-27 · logsource: product=windows category=process_creation · f91e51c9-f344-4b32-969b-0b6f6b8537d4
Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks.
One of the very common persistence techniques is schedule malicious tasks using schtasks.exe.
Since, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.
Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems)
· 2020-07-03 (modified 2026-03-16) · logsource: product=windows category=process_creation · fff9d2b7-e11c-4a69-93d3-40ef66189767
Detects a suspicious copy operation that tries to copy a program from system (System32, SysWOW64, WinSxS) directories to another on disk.
Often used to move LOLBINs such as 'certutil' or 'desktopimgdownldr' to a different location with a different name in order to bypass detections based on locations.
Rules tagged at the parent level (attack.t1036) 40
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Micah Babinski
· 2022-12-11 (modified 2023-03-05) · logsource: product=windows category=process_creation · 0c92f2e6-f08f-4b73-9216-ecb0ca634689
Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2024-01-17 · logsource: product=windows category=process_creation · 12fbff88-16b5-4b42-9754-cd001a789fb3
Detects a CodePage modification using the "mode.com" utility to Russian language.
This behavior has been used by threat actors behind Dharma ransomware.
Author: Christian Burkard (Nextron Systems)
· 2021-10-26 (modified 2023-03-29) · logsource: product=windows category=process_creation · 1327381e-6ab0-4f38-b583-4c1b8346a56b
Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline
Author: juju4, Jonhnathan Ribeiro, oscd.community
· 2019-01-16 (modified 2022-01-07) · logsource: product=windows category=process_creation · 15b75071-74cc-47e0-b4c6-b43744a62a2b
Detects suspicious process run from unusual locations
Author: Florian Roth (Nextron Systems)
· 2022-09-20 (modified 2023-02-14) · logsource: product=windows category=process_creation · 1a1ed54a-2ba4-4221-94d5-01dee560d71e
Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-06 (modified 2023-02-03) · logsource: product=windows category=process_creation · 1c12727d-02bf-45ff-a9f3-d49806a3cf43
Detects the execution of a renamed version of the Plink binary
Author: Florian Roth (Nextron Systems)
· 2021-08-16 (modified 2026-06-29) · logsource: product=windows category=process_creation · 2e65275c-8288-4ab4-aeb7-6274f58b6b20
Detects usage of the SysInternals Procdump utility
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-06-02 (modified 2025-08-05) · logsource: product=linux category=process_creation · 312b42b1-bded-4441-8b58-163a3af58775
Detects a potentially suspicious execution of a process located in the '/tmp/' folder
Author: Micah Babinski, @micahbabinski
· 2023-05-07 · logsource: product=windows category=process_creation · 32e280f1-8ad4-46ef-9e80-910657611fbc
Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.
This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.
Author: Trent Liffick
· 2020-05-01 (modified 2024-01-15) · logsource: product=windows category=process_creation · 33339be3-148b-4e16-af56-ad16ec6c7e7b
Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2020-01-28 (modified 2025-01-22) · logsource: product=windows category=process_creation · 340a090b-c4e9-412e-bb36-b4b16fe96f9b
Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central.
This binary can be abused for DLL injection, arbitrary command and process execution.
Author: Florian Roth (Nextron Systems)
· 2022-10-14 (modified 2024-08-29) · logsource: product=windows category=process_creation · 396f6630-f3ac-44e3-bfc8-1b161bc00c4e
Detects suspicious Windows Error Reporting manager (wermgr.exe) child process
Author: Florian Roth (Nextron Systems)
· 2018-03-13 (modified 2024-01-18) · logsource: product=windows category=process_creation · 3d7679bd-0c00-440c-97b0-3f204273e6c7
Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC
Author: Florian Roth (Nextron Systems), Tim Shelton
· 2019-01-16 (modified 2024-07-12) · logsource: product=windows category=process_creation · 3dfd06d2-eaf4-4532-9555-68aca59f57c4
Detects a potentially suspicious execution from an uncommon folder.
Author: Florian Roth (Nextron Systems)
· 2021-12-22 (modified 2022-12-25) · logsource: product=windows service=security · 45eb2ae2-9aa2-4c3a-99a5-6e5077655466
Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287
Author: Sreeman
· 2020-04-17 (modified 2024-02-08) · logsource: product=windows category=process_creation · 4e762605-34a8-406d-b72e-c1a089313320
HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications.
HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files".
Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe
Author: Micah Babinski, @micahbabinski
· 2023-05-08 · logsource: product=windows category=file_event · 4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6
Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.
This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-01-04 (modified 2022-08-19) · logsource: product=windows category=process_creation · 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48
Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Author: Florian Roth (Nextron Systems)
· 2022-02-26 (modified 2023-11-11) · logsource: product=windows category=process_creation · 52d097e2-063e-4c9c-8fbb-855c8948d135
Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command line flags
Author: Florian Roth (Nextron Systems)
· 2022-05-09 · logsource: product=windows service=security · 54f0434b-726f-48a1-b2aa-067df14516e4
Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.
Author: Florian Roth (Nextron Systems)
· 2018-10-30 (modified 2025-10-19) · logsource: product=windows category=process_creation · 5afee48e-67dd-4e03-a783-f74259dcf998
Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump.
This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers.
LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory.
Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation.
Author: Florian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
· 2020-02-18 (modified 2025-02-23) · logsource: product=windows category=process_creation · 646ea171-dded-4578-8a4d-65e9822892e3
Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)
Author: Florian Roth (Nextron Systems)
· 2022-01-28 (modified 2023-02-08) · logsource: product=windows category=process_creation · 66e563f9-1cbd-4a22-a957-d8b7c0f44372
Detects suspicious use of XORDump process memory dumping utility
Author: Florian Roth (Nextron Systems)
· 2019-02-09 (modified 2023-11-09) · logsource: product=windows category=process_creation · 737e618a-a410-49b5-bec3-9e55ff7fbc15
Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion.
Author: Florian Roth (Nextron Systems)
· 2022-01-11 (modified 2023-05-09) · logsource: product=windows category=process_creation · 79b06761-465f-4f88-9ef2-150e24d3d737
Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name
Author: Nextron Systems
· 2022-06-01 (modified 2023-02-06) · logsource: product=windows category=process_creation · 7a74da6b-ea76-47db-92cc-874ad90df734
Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber
· 2019-06-29 (modified 2025-10-31) · logsource: product=windows category=process_creation · 949f1ffb-6e85-4f00-ae1e-c3c5b190d605
Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries,
which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"
Author: Florian Roth (Nextron Systems)
· 2018-03-18 (modified 2022-05-27) · logsource: product=windows category=process_creation · 9fff585c-c33e-4a86-b3cd-39312079a65f
Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-12 (modified 2025-10-07) · logsource: product=windows category=file_event · b8fd0e93-ff58-4cbd-8f48-1c114e342e62
Detects Windows executables that write files with suspicious extensions
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
· 2019-10-14 (modified 2023-03-07) · logsource: product=windows category=process_creation · c7942406-33dd-4377-a564-0f62db0593a3
Detects a code page switch in command line or batch scripts to a rare language
Author: Florian Roth (Nextron Systems)
· 2022-03-21 (modified 2022-09-08) · logsource: product=windows category=process_creation · cbec226f-63d9-4eca-9f52-dfb6652f24df
Detects suspicious parent processes that should not have any children or should only have a single possible child program
Author: Ilyas Ochkov, oscd.community
· 2019-10-25 (modified 2024-01-16) · logsource: product=windows service=security · cfeed607-6aa4-4bbd-9627-b637deb723c8
Detects the creation of a user with the "$" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.
Author: Nasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk
· 2024-01-19 · logsource: product=windows category=process_creation · d48c5ffa-3b02-4c0f-9a9e-3c275650dd0e
Detects a CodePage modification using the "mode.com" utility.
This behavior has been used by threat actors behind Dharma ransomware.
Author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
· 2022-04-06 (modified 2023-04-12) · logsource: product=windows category=process_creation · dee0a7a3-f200-4112-a99b-952196d81e42
Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"
Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2017-11-27 (modified 2026-07-28) · logsource: product=windows category=process_creation · e4a6b256-3e47-40fc-89d2-7a477edd6915
Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.
Author: Florian Roth (Nextron Systems)
· 2022-03-14 · logsource: product=linux category=process_creation · ea3ecad2-db86-4a89-ad0b-132a10d2db55
Detects suspicious interactive bash as a parent to rather uncommon child processes
Author: Florian Roth (Nextron Systems)
· 2022-04-06 (modified 2023-04-12) · logsource: product=windows category=process_creation · eb1c4225-1c23-4241-8dd4-051389fde4ce
Detects suspicious ways to use the "DumpMinitool.exe" binary
Author: Nextron Systems, @Kostastsale
· 2022-06-01 (modified 2024-08-23) · logsource: product=windows category=process_creation · f3d39c45-de1a-4486-a687-ab126124f744
Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)
Author: Nasreddine Bencherchali (Nextron Systems), Anish Bogati
· 2024-01-05 · logsource: product=windows category=process_creation · f53714ec-5077-420e-ad20-907ff9bb2958
Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.
Author: X__Junior (Nextron Systems)
· 2023-06-30 · logsource: product=windows category=process_creation · fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd
Detects execution of "WerFault.exe" with the "-pr" commandline flag that is used to run files stored in the ReflectDebugger key which could be used to store the path to the malware in order to masquerade the execution flow