Masquerading: Rename Legitimate Utilities
- ID
- T1036.003
- Tactics
- TA0005 Stealth
- Sub-technique of
- T1036 Masquerading
- Platforms
- Linux, macOS, Windows
- Data sources
- Process Creation, File Creation, Command Execution, Process Metadata, File Modification, File Metadata
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.[1][2][3][4] It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe).[5] An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.[6]
Detection
- DET0005 Renamed Legitimate Utility Execution with Metadata Mismatch and Suspicious Path
Data components: Process Creation, File Creation, Command Execution, Process Metadata, File Modification, File Metadata
Mitigations (1)
- M1022 Restrict File and Directory Permissions
Use file system access controls to protect folders such as
C:\Windows\System32.