T1036.003Stealth
Rename Legitimate Utilities
Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython. It may be possible to bypass those security mechanisms by…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
27 Sigma rules tagged T1036.003Rename Legitimate UtilitiesT1036.00327 general rules
- File Download Via Bitsadmin To A Suspicious Target Folderhightest
- File With Suspicious Extension Downloaded Via Bitsadminhightest
- LOL-Binary Copied From System Directoryhightest
- Potential Defense Evasion Via Rename Of Highly Relevant Binarieshightest
- Potential WerFault ReflectDebugger Registry Value Abusehightest
- Ps.exe Renamed SysInternals Toolhightest
- Renamed BrowserCore.EXE Executionhightest
- Renamed Jusched.EXE Executionhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Rename Legitimate Utilities
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.