Automation · API / MCP 中文

Technique note · T1036.003

Rename Legitimate Utilities

Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython. It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename <code>rundll32.exe</code>). An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.

ATT&CK T1036.003 platforms — Status Active Version 20.1

Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.1234 It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename <code>rundll32.exe</code>).5 An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.6

  1. LOLBAS Main Site
  2. Huntress Python Malware 2025
  3. The DFIR Report AutoHotKey 2023
  4. Splunk Detect Renamed PSExec
  5. Elastic Masquerade Ball
  6. F-Secure CozyDuke

Groups using this technique

GroupNameCountry
grp_g1034Daggerfly—
grp_g0032Lazarus GroupDPRK
grp_g0093GALLIUM—
grp_g0082APT38DPRK
grp_g0045menuPass—
grp_g0050APT32Vietnam

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.