Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. (Citation: LOLBAS Main Site) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename <code>rundll32.exe</code>). (Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths. (Citation: F-Secure CozyDuke)
Rename System Utilities
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1036/003  external_id: T1036.003     source_name: Twitter ItsReallyNick Masquerading Update  description: Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved April 22, 2019.  url: https://twitter.com/ItsReallyNick/status/1055321652777619457     source_name: Elastic Masquerade Ball  description: Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball. Retrieved October 31, 2016.  url: https://www.elastic.co/blog/how-hunt-masquerade-ball     source_name: F-Secure CozyDuke  description: F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis. Retrieved December 10, 2015.  url: https://www.f-secure.com/documents/996508/1030745/CozyDuke     source_name: LOLBAS Main Site  description: LOLBAS. (n.d.). Living Off The Land Binaries and Scripts (and also Libraries). Retrieved February 10, 2020.  url: https://lolbas-project.github.io/     