Tactic: Stealth · Platforms: Linux, macOS, Windows
Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such…
title: "T1036.003 Masquerading: Rename Legitimate Utilities"
id: c9fb0160-0e6a-4c8e-b17f-1554607efa74
description: 'Detects a legitimate Windows utility executed under a different filename by comparing the PE OriginalFileName metadata against the Image path — a renamed binary keeps its original internal name but its Image no longer ends with that name. Tune using: ImagePath, PEInternalNameMismatch, CommandLinePattern.'
references:
- https://attack.mitre.org/techniques/T1036/003
author: Shahrukh Khan
date: 2026-05-23
license: MIT
tags:
- attack.stealth
- attack.t1036.003
logsource:
category: process_creation
product: windows
detection:
selection_rundll32:
OriginalFileName: 'RUNDLL32.EXE'
filter_rundll32:
Image|endswith: '\rundll32.exe'
selection_svchost:
OriginalFileName: 'svchost.exe'
filter_svchost:
Image|endswith: '\svchost.exe'
selection_csrss:
OriginalFileName: 'csrss.exe'
filter_csrss:
Image|endswith: '\csrss.exe'
selection_psexec:
OriginalFileName|contains: 'psexec'
filter_psexec:
Image|endswith:
- '\psexec.exe'
- '\psexesvc.exe'
- '\psexec64.exe'
condition: (selection_rundll32 and not filter_rundll32) or (selection_svchost and not filter_svchost) or (selection_csrss and not filter_csrss) or (selection_psexec and not filter_psexec)
falsepositives:
- Portable or repackaged legitimate third-party tools that legitimately embed one of these OriginalFileName values while running under a different filename are uncommon; verify Company/Signed/Hashes fields before escalating.
level: high
title: "T1036.003 Masquerading: Rename Legitimate Utilities"
id: 6e73e268-7e19-4753-b0d1-ae7601eb758e
description: 'Renamed Legitimate Utility Execution with Metadata Mismatch. Replaced the /tmp-only path gate with a per-utility canonical-path allowlist, so the rule now fires whenever a process claims to be bash/sh/sshd/cron (comm) but its actual executable is not one of that utility''s legitimate system paths -- the real signature of masquerading/renaming -- rather than only catching a correctly-named binary staged in /tmp. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecutionPath, ParentProcessContext, TimeWindow.'
references:
- https://attack.mitre.org/techniques/T1036/003
author: Shahrukh Khan
date: 2026-04-19
license: MIT
tags:
- attack.stealth
- attack.t1036.003
logsource:
category: process_creation
product: linux
detection:
selection:
type: SYSCALL
syscall: execve
comm:
- 'bash'
- 'sh'
- 'sshd'
- 'cron'
filter_bash_legit:
comm: 'bash'
exe:
- '/bin/bash'
- '/usr/bin/bash'
filter_sh_legit:
comm: 'sh'
exe:
- '/bin/sh'
- '/usr/bin/sh'
- '/bin/dash'
- '/usr/bin/dash'
filter_sshd_legit:
comm: 'sshd'
exe:
- '/usr/sbin/sshd'
- '/usr/bin/sshd'
filter_cron_legit:
comm: 'cron'
exe:
- '/usr/sbin/cron'
- '/usr/sbin/crond'
- '/usr/bin/crond'
condition: selection and not 1 of filter_*_legit
falsepositives:
- Custom-built or statically-linked utilities intentionally installed under a nonstandard-but-legitimate path (e.g. Alpine/musl images, chroot or container root filesystems, vendor appliances shipping these tools outside standard system directories); update the per-comm exe allowlist for the environment''s known-good paths.
level: high