Rename Legitimate Utilities
Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.(Citation: LOLBAS Main Site)(Citation: Huntress Python Malware 2025)(Citation: The DFIR Report AutoHotKey 2023)(Citation: Splunk Detect Renamed PSExec) It may be po...
BY SOURCE
PROCEDURES (27)
Auto-extracted: 8 detections for process creation monitoring
Auto-extracted: 5 detections for download
Auto-extracted: 3 detections for script execution monitoring
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for remote
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for unusual
Auto-extracted: 2 detections for bypass
Auto-extracted: 2 detections for general monitoring
Auto-extracted: 2 detections for registry
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for masquerad
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for obfuscat
Auto-extracted: 1 detections for obfuscat
Auto-extracted: 1 detections for evasion