T1036.003 Rename Legitimate Utilities — Detection Rules

Source-backed rule directory

• Masquerading as Linux Crond Process · test · medium · {"product":"linux","service":"auditd"}
• Remote Access Tool - Renamed MeshAgent Execution - MacOS · experimental · high · {"category":"process_creation","product":"macos"}
• Potential Homoglyph Attack Using Lookalike Characters in Filename · test · medium · {"category":"file_event","product":"windows"}
• Renamed Powershell Under Powershell Channel · test · low · {"product":"windows","category":"ps_classic_start"}
• Suspicious Start-Process PassThru · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• File Download Via Bitsadmin · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Download From Direct IP Via Bitsadmin · test · high · {"category":"process_creation","product":"windows"}
• Suspicious Download From File-Sharing Website Via Bitsadmin · test · high · {"category":"process_creation","product":"windows"}
• File With Suspicious Extension Downloaded Via Bitsadmin · test · high · {"category":"process_creation","product":"windows"}
• File Download Via Bitsadmin To A Suspicious Target Folder · test · high · {"category":"process_creation","product":"windows"}
• PUA - Potential PE Metadata Tamper Using Rcedit · test · medium · {"category":"process_creation","product":"windows"}
• Remote Access Tool - Renamed MeshAgent Execution - Windows · experimental · high · {"category":"process_creation","product":"windows"}
• Potential Defense Evasion Via Binary Rename · test · medium · {"category":"process_creation","product":"windows"}
• Potential Defense Evasion Via Rename Of Highly Relevant Binaries · test · high · {"category":"process_creation","product":"windows"}
• Renamed BrowserCore.EXE Execution · test · high · {"category":"process_creation","product":"windows"}
• Renamed Jusched.EXE Execution · test · high · {"category":"process_creation","product":"windows"}
• Renamed Msdt.EXE Execution · test · high · {"category":"process_creation","product":"windows"}
• Renamed Office Binary Execution · test · high · {"category":"process_creation","product":"windows"}
• Renamed Schtasks Execution · experimental · high · {"category":"process_creation","product":"windows"}
• Renamed ProcDump Execution · test · high · {"product":"windows","category":"process_creation"}
• Suspicious Copy From or To System Directory · test · medium · {"category":"process_creation","product":"windows"}
• LOL-Binary Copied From System Directory · test · high · {"category":"process_creation","product":"windows"}
• Potential Homoglyph Attack Using Lookalike Characters · test · medium · {"category":"process_creation","product":"windows"}
• Windows Processes Suspicious Parent Directory · test · low · {"category":"process_creation","product":"windows"}
• Potential WerFault ReflectDebugger Registry Value Abuse · test · high · {"category":"registry_set","product":"windows"}
• Potential PendingFileRenameOperations Tampering · test · medium · {"category":"registry_set","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0005 Renamed Legitimate Utility Execution with Metadata Mismatch and Suspicious Path

AN0012 Analytic 0012

Execution of binaries where the on-disk filename does not match PE metadata such as OriginalFilename or InternalName. Often observed with renamed LOLBAS or system binaries like rundll32, powershell, or psexec.

AN0013 Analytic 0013

Execution of renamed or relocated native macOS utilities with uncommon names or non-default paths (e.g., renamed `osascript`, `bash`, or `curl`).

AN0014 Analytic 0014

Execution of renamed common utilities (e.g., `bash`, `nc`, `python`, `sh`) from atypical directories or with names intended to deceive defenders or EDRs.