Masquerading: Rename System Utilities

Created the Friday 10 February 2023. Updated 1 year, 6 months ago.

Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths.

Technique Identifier

T1036.003

Technique Tags

Defense Evasion rename legitimate file APT32 replace legitimate system file

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Masquerading: Rename System Utilities, Sub-technique T1036.003 - Enterprise | MITRE ATT&CK®