Detect Rename Legitimate Utilities in Google Chronicle
Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing, including PSExec, certutil, rundll32, and mshta. It may be possible to bypass those security mechanisms by renaming the utility prior to utilization. An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1036 Masquerading
- Sub-technique
- T1036.003 Rename Legitimate Utilities
- Canonical reference
- https://attack.mitre.org/techniques/T1036/003/
YARA-L Detection Query
rule renamed_legitimate_utilities_t1036_003 {
meta:
author = "Argus Detection Engineering"
description = "Detects renamed legitimate Windows system utilities via PE OriginalFileName vs actual process filename mismatch"
mitre_attack_tactic = "Defense Evasion"
mitre_attack_technique = "T1036.003"
severity = "HIGH"
confidence = "HIGH"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
re.regex($e.target.process.file.pe_file.original_file_name,
`(?i)^(cmd\.exe|powershell\.exe|pwsh\.exe|rundll32\.exe|mshta\.exe|certutil\.exe|wscript\.exe|cscript\.exe|regsvr32\.exe|msbuild\.exe|psexec\.exe|psexesvc\.exe|bitsadmin\.exe|wmic\.exe)$`)
not re.regex($e.target.process.file.names,
`(?i)^(cmd\.exe|powershell\.exe|pwsh\.exe|rundll32\.exe|mshta\.exe|certutil\.exe|wscript\.exe|cscript\.exe|regsvr32\.exe|msbuild\.exe|psexec\.exe|psexesvc\.exe|bitsadmin\.exe|wmic\.exe)$`)
condition:
$e
}Chronicle YARA-L 2.0 detection rule that identifies renamed legitimate Windows utilities using UDM process launch events. Matches on the PE OriginalFileName UDM field (target.process.file.pe_file.original_file_name) for known LOLBins and negates events where the process file names repeated field already matches the expected executable name, surfacing only cases where the binary was renamed prior to execution. Requires Windows endpoint telemetry ingested via Chronicle forwarder or a Defender for Endpoint / Sysmon Chronicle connector with PE metadata enrichment.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise UEM or MDM platforms (Microsoft Intune, VMware Workspace ONE UEM) that execute renamed system utilities during policy enforcement, compliance scanning, or device enrollment workflows
- Google Chrome Enterprise distribution packages or third-party browser deployment tooling that bundles renamed Windows utilities for cross-version compatibility or sandboxed execution
- Forensics and incident response collection toolkits that deliberately rename system utilities to staging directories for offline analysis or evidence preservation environments
Other platforms for T1036.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Rename cmd.exe and Execute
Expected signal: Sysmon Event ID 1: Process Create with Image=%TEMP%\notcmd.exe, OriginalFileName=Cmd.Exe. The OriginalFileName mismatch is the key detection indicator.
- Test 2Rename certutil.exe for Download Cradle
Expected signal: Sysmon Event ID 1: Process Create with Image=%TEMP%\cert_helper.exe, OriginalFileName=CertUtil.exe, CommandLine containing -urlcache. Network connection event (Sysmon ID 3) to 127.0.0.1.
- Test 3Rename rundll32.exe for Proxy Execution
Expected signal: Sysmon Event ID 1: Process Create with Image in ProgramData, OriginalFileName=RUNDLL32.EXE. File creation event for dbengin.exe in the PlayReady directory.
References (7)
- https://attack.mitre.org/techniques/T1036/003/
- https://www.elastic.co/blog/how-hunt-masquerade-ball
- https://lolbas-project.github.io/
- https://www.f-secure.com/documents/996508/1030745/CozyDuke
- https://research.splunk.com/endpoint/683e6196-b8e8-11eb-9a79-acde48001122/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.md
- https://x.com/ItsReallyNick/status/1055321652777619457
Unlock Pro Content
Get the full detection package for T1036.003 including response playbook, investigation guide, and atomic red team tests.