Cross-source coverage

T1036.003 / ATT&CK

Masquerading: Rename Legitimate Utilities

57 rules across 6 sources.

1 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython. It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.

Tactics
Stealth
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SysmonEDR:AMSImacos:unifiedlogmacos:endpointsecurityfs:fileeventsauditd:SYSCALLlinux:osquerylinux:syslog

How MITRE says to detect it DET0005

Renamed Legitimate Utility Execution with Metadata Mismatch and Suspicious Path

Windows Analytic 0012

Execution of binaries where the on-disk filename does not match PE metadata such as OriginalFilename or InternalName. Often observed with renamed LOLBAS or system binaries like rundll32, powershell, or psexec.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=11
  • EDR:AMSI None

macOS Analytic 0013

Execution of renamed or relocated native macOS utilities with uncommon names or non-default paths (e.g., renamed `osascript`, `bash`, or `curl`).

  • macos:unifiedlog subsystem=com.apple.process
  • macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC
  • fs:fileevents /var/log/quarantine.log

Linux Analytic 0014

Execution of renamed common utilities (e.g., `bash`, `nc`, `python`, `sh`) from atypical directories or with names intended to deceive defenders or EDRs.

  • auditd:SYSCALL execve
  • linux:osquery event-based
  • linux:syslog cron activity

View on attack.mitre.org ↗

SigmaHQ/sigma

27 rules
Detection Severity Format
File Download Via Bitsadmin To A Suspicious Target Folder High Sigma
File With Suspicious Extension Downloaded Via Bitsadmin High Sigma
LOL-Binary Copied From System Directory High Sigma
Potential Defense Evasion Via Rename Of Highly Relevant Binaries High Sigma
Potential WerFault ReflectDebugger Registry Value Abuse High Sigma
Ps.exe Renamed SysInternals Tool High Sigma
Remote Access Tool - Renamed MeshAgent Execution - MacOS High Sigma
Remote Access Tool - Renamed MeshAgent Execution - Windows High Sigma
Renamed BrowserCore.EXE Execution High Sigma
Renamed Jusched.EXE Execution High Sigma

+ 17 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

11 rules
Detection Severity Format
Potential Credential Access via Renamed COM+ Services DLL High Elastic TOML
Renamed Automation Script Interpreter High Elastic TOML
Suspicious Microsoft Antimalware Service Execution High Elastic TOML
Suspicious Microsoft Diagnostics Wizard Execution High Elastic TOML
Potential Data Exfiltration via Rclone Medium Elastic TOML
Potential Kubectl Masquerading via Unexpected Process Medium Elastic TOML
Renamed Utility Executed with Short Program Name Medium Elastic TOML
Suspicious Process Execution via Renamed PsExec Executable Medium Elastic TOML
Suspicious Renaming of ESXI Files Medium Elastic TOML
System Binary Moved or Copied Medium Elastic TOML

+ 1 more from elastic/detection-rules → showing the 10 highest-severity

splunk/security_content

10 rules
Detection Severity Format
Execution of File with Multiple Extensions Undefined SPL
Suspicious Copy on System32 Undefined SPL
Suspicious microsoft workflow compiler rename Undefined SPL
Suspicious msbuild path Undefined SPL
Suspicious MSBuild Rename Undefined SPL
System Processes Run From Unexpected Locations Undefined SPL
Windows DotNet Binary in Non Standard Path Undefined SPL
Windows InstallUtil in Non Standard Path Undefined SPL
Windows LOLBAS Executed As Renamed File Undefined SPL
Windows Renamed Powershell Execution Undefined SPL

elastic/protections-artifacts

5 rules
Detection Severity Format
Renamed AutoIt Scripts Interpreter Undefined Elastic TOML
Renamed Third Party Administrator Tools Undefined Elastic TOML
Renamed Windows Automaton Script Interpreter Undefined Elastic TOML
Suspicious Windows LUA Script Execution Undefined Elastic TOML
System Binary Copied or Moved Undefined Elastic TOML

Wazuh Core Ruleset

3 rules
Detection Severity Format
Masqueraded CertUtil.exe used to decode binary file Critical Wazuh XML
Masqueraded CertUtil.exe with a different file name. Possible use to decode malware Critical Wazuh XML
Executed a renamed copy of wscript.exe High Wazuh XML

socfortress/Wazuh-Rules

1 rule
Detection Severity Format
Copying system shell to /tmp with new name — potential masquerading (T1036.003) High Wazuh XML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.