type: attack-pattern
spec_version: 2.1
id: attack-pattern--bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b
created: 2020-02-10T20:03:11.691Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1036/003
external_id: T1036.003
source_name: Twitter ItsReallyNick Masquerading Update
description: Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved September 12, 2024.
url: https://x.com/ItsReallyNick/status/1055321652777619457
source_name: Elastic Masquerade Ball
description: Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball. Retrieved October 31, 2016.
url: https://www.elastic.co/blog/how-hunt-masquerade-ball
source_name: F-Secure CozyDuke
description: F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis. Retrieved December 10, 2015.
url: https://www.f-secure.com/documents/996508/1030745/CozyDuke
source_name: LOLBAS Main Site
description: LOLBAS. (n.d.). Living Off The Land Binaries and Scripts (and also Libraries). Retrieved February 10, 2020.
url: https://lolbas-project.github.io/
source_name: Huntress Python Malware 2025
description: Matthew Brennan. (2024, July 5). Snakes on a Domain: An Analysis of a Python Malware Loader. Retrieved April 3, 2025.
url: https://www.huntress.com/blog/snakes-on-a-domain-an-analysis-of-a-python-malware-loader
source_name: Splunk Detect Renamed PSExec
description: Splunk. (2025, February 24). Detection: Detect Renamed PSExec. Retrieved April 3, 2025.
url: https://research.splunk.com/endpoint/683e6196-b8e8-11eb-9a79-acde48001122/
source_name: The DFIR Report AutoHotKey 2023
description: The DFIR Report. (2023, February 6). Collect, Exfiltrate, Sleep, Repeat. Retrieved April 3, 2025.
url: https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:18.517Z
name: Rename Legitimate Utilities
description: Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.(Citation: LOLBAS Main Site)(Citation: Huntress Python Malware 2025)(Citation: The DFIR Report AutoHotKey 2023)(Citation: Splunk Detect Renamed PSExec) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe).(Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.(Citation: F-Secure CozyDuke)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Matt Anderson, @‌nosecurething, Huntress
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
macOS
Windows
x_mitre_version: 2.0