Threat intelligence / Technique

Rename Legitimate Utilities

Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.(Citation: LOLBAS Main Site)(Citation: Huntress Python Malware 2025)(Citation: The DFIR Report AutoHotKey 2023)(Citation: Splunk Detect Renamed PSExec) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe ).(Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.(Citation: F-Secure CozyDuke)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.(Citation: LOLBAS Main Site)(Citation: Huntress Python Malware 2025)(Citation: The DFIR Report AutoHotKey 2023)(Citation: Splunk Detect Renamed PSExec) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe ).(Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.(Citation: F-Secure CozyDuke)

14 recorded

Relationships

mapped-to

from File Manipulation

Technique

mitigates

from Restrict File and Directory Permissions

Mitigation

subtechnique-of

to Masquerading

Technique

uses

from APT32

Group

uses

from APT38

Group

uses

Malware

uses

Group

uses

Malware

uses

Group

uses

from Kevin

Malware

uses

from Lazarus Group

Group

uses

Group

uses

Malware

uses

from StrelaStealer

Malware

7 external

References

mitre-attack

T1036.003

Elastic Masquerade Ball

https://www.elastic.co/blog/how-hunt-masquerade-ball

F-Secure CozyDuke

https://www.f-secure.com/documents/996508/1030745/CozyDuke

LOLBAS Main Site

https://lolbas-project.github.io/

Huntress Python Malware 2025

https://www.huntress.com/blog/snakes-on-a-domain-an-analysis-of-a-python-malware-loader

Splunk Detect Renamed PSExec

https://research.splunk.com/endpoint/683e6196-b8e8-11eb-9a79-acde48001122/

The DFIR Report AutoHotKey 2023

https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/