Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for T1036.003.
Upgrade to ProDetect Rename Legitimate Utilities in CrowdStrike LogScale
Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing, including PSExec, certutil, rundll32, and mshta. It may be possible to bypass those security mechanisms by renaming the utility prior to utilization. An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1036 Masquerading
- Sub-technique
- T1036.003 Rename Legitimate Utilities
- Canonical reference
- https://attack.mitre.org/techniques/T1036/003/
LogScale Detection Query
#event_simpleName=ProcessRollup2
| OriginalFilename=/(?i)^(cmd\.exe|powershell\.exe|pwsh\.exe|rundll32\.exe|mshta\.exe|certutil\.exe|wscript\.exe|cscript\.exe|regsvr32\.exe|msbuild\.exe|psexec\.exe|psexesvc\.exe|bitsadmin\.exe|wmic\.exe)$/
| LowerFileName := lower(FileName)
| !in(field=LowerFileName, values=["cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "mshta.exe", "certutil.exe", "wscript.exe", "cscript.exe", "regsvr32.exe", "msbuild.exe", "psexec.exe", "psexesvc.exe", "bitsadmin.exe", "wmic.exe"])
| table([_time, ComputerName, UserName, FileName, OriginalFilename, CommandLine, ParentBaseFileName, SHA256HashData])
| sort(field=_time, order=desc)CrowdStrike LogScale (CQL) query against Falcon sensor ProcessRollup2 process creation events that detects renamed legitimate Windows utilities. Matches on the PE OriginalFilename field using a case-insensitive regex for monitored LOLBins, then derives a lowercase version of the actual FileName field and uses the !in() filter to exclude events where the filename already matches the expected name, surfacing only instances where a utility was renamed before execution. Requires CrowdStrike Falcon sensor with Endpoint Activity Monitoring (EAM) and PE metadata enrichment enabled in the policy.
Data Sources
Required Tables
False Positives & Tuning
- Managed service provider RMM agents (ConnectWise Automate, Datto RMM, NinjaRMM) that ship renamed administrative utilities as part of self-contained agent packages installed on managed endpoints
- Software update and patch management mechanisms that extract and temporarily rename Windows system tools to staging directories before in-place replacement during update cycles
- Container or VM management tools (Docker Desktop for Windows, Hyper-V management utilities) that copy and rename system utilities into isolated execution environments for compatibility purposes
Other platforms for T1036.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Rename cmd.exe and Execute
Expected signal: Sysmon Event ID 1: Process Create with Image=%TEMP%\notcmd.exe, OriginalFileName=Cmd.Exe. The OriginalFileName mismatch is the key detection indicator.
- Test 2Rename certutil.exe for Download Cradle
Expected signal: Sysmon Event ID 1: Process Create with Image=%TEMP%\cert_helper.exe, OriginalFileName=CertUtil.exe, CommandLine containing -urlcache. Network connection event (Sysmon ID 3) to 127.0.0.1.
- Test 3Rename rundll32.exe for Proxy Execution
Expected signal: Sysmon Event ID 1: Process Create with Image in ProgramData, OriginalFileName=RUNDLL32.EXE. File creation event for dbengin.exe in the PlayReady directory.
References (5)
Unlock playbooks & atomic tests with Pro
Get the full detection package for T1036.003 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month