Home/ MITRE Matrix/ Defense Evasion/ T1036.003

T1036.003Rename Legitimate Utilities

T1036.003 — Rename Legitimate Utilities is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 12 detection use cases covering it.

Defense Evasion

View on the matrix → Filter Detection Library MITRE official spec ↗

12Use cases

0Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1036 · Masquerading

Use cases covering this technique (12)

Execution of File with Multiple Extensions ESCU actions · alerting P Suspicious Copy on System32 ESCU actions · hunting P Suspicious microsoft workflow compiler rename ESCU actions · hunting P Suspicious msbuild path ESCU actions · alerting P Suspicious MSBuild Rename ESCU actions · hunting P System Processes Run From Unexpected Locations ESCU actions · hunting P Windows DotNet Binary in Non Standard Path ESCU actions · alerting P Windows InstallUtil in Non Standard Path ESCU actions · alerting P Windows LOLBAS Executed As Renamed File ESCU actions · alerting P Windows Renamed Powershell Execution ESCU actions · alerting P Execution of File With Spaces Before Extension ESCU actions · alerting P Suspicious Rundll32 Rename ESCU actions · hunting P