{"id":"T1036.003","name":"Rename Legitimate Utilities","url":"https://attack.mitre.org/techniques/T1036/003","tactics":["stealth"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0005","stix_id":"x-mitre-detection-strategy--c2648552-806d-40ec-8ea7-59f4e44983eb","name":"Renamed Legitimate Utility Execution with Metadata Mismatch and Suspicious Path","url":"https://attack.mitre.org/detectionstrategies/DET0005","analytics":[{"id":"AN0012","stix_id":"x-mitre-analytic--ec036273-4e90-465e-b115-a69bbb68dde4","name":"Analytic 0012","description":"Execution of binaries where the on-disk filename does not match PE metadata such as OriginalFilename or InternalName. Often observed with renamed LOLBAS or system binaries like rundll32, powershell, or psexec.","url":"https://attack.mitre.org/detectionstrategies/DET0005#AN0012","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"EDR:AMSI","channel":"None","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"edr-amsi"}],"mutable_elements":[{"field":"ImagePath","description":"Filter by suspicious or non-standard directory paths"},{"field":"PEInternalNameMismatch","description":"Enable tuning based on mismatch rules between metadata and disk filename"},{"field":"CommandLinePattern","description":"Flag unusual or rare argument combinations for LOLBAS-like tools"}],"live":true,"detection_strategies":["DET0005"],"techniques":["T1036.003"]},{"id":"AN0013","stix_id":"x-mitre-analytic--3349af7c-3cea-4424-b2a4-056fedb63831","name":"Analytic 0013","description":"Execution of renamed or relocated native macOS utilities with uncommon names or non-default paths (e.g., renamed `osascript`, `bash`, or `curl`).","url":"https://attack.mitre.org/detectionstrategies/DET0005#AN0013","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"subsystem=com.apple.process","data_component":"DC0034","data_component_name":"Process Metadata","log_source_slug":"macos-unifiedlog"},{"name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_EXEC","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-endpointsecurity"},{"name":"fs:fileevents","channel":"/var/log/quarantine.log","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"fs-fileevents"}],"mutable_elements":[{"field":"PathDeviation","description":"Path deviation from expected directory (e.g., /usr/bin/ vs /tmp/)"},{"field":"BinaryHashReputation","description":"Enable tuning based on hash matching known signed versions vs suspicious clones"},{"field":"UserRole","description":"Scope detections based on non-admin users using admin-level tools"}],"live":true,"detection_strategies":["DET0005"],"techniques":["T1036.003"]},{"id":"AN0014","stix_id":"x-mitre-analytic--bd8beea8-48c8-41dc-8991-f8c739d10c70","name":"Analytic 0014","description":"Execution of renamed common utilities (e.g., `bash`, `nc`, `python`, `sh`) from atypical directories or with names intended to deceive defenders or EDRs.","url":"https://attack.mitre.org/detectionstrategies/DET0005#AN0014","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:osquery","channel":"event-based","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"linux-osquery"},{"name":"linux:syslog","channel":"cron activity","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"ExecutionPath","description":"Path anomalies such as execution from /dev/shm, /tmp, or user home directories"},{"field":"ParentProcessContext","description":"Unusual lineage such as scripts invoking renamed tools"},{"field":"TimeWindow","description":"Correlate between file rename and immediate execution"}],"live":true,"detection_strategies":["DET0005"],"techniques":["T1036.003"]}],"live":true,"version":"1.0","techniques":["T1036.003"]}],"sigma_rules":[{"id":"0718cd72-f316-4aa2-988f-838ea8533277","title":"Suspicious Start-Process PassThru","author":"frack113","status":"test","level":"medium","date":"2022-01-15","modified":"2026-05-18","description":"Powershell use PassThru option to start in background","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036.003/T1036.003.md","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-process?view=powershell-7.6"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1036.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_start_process.yml","techniques":["T1036.003"],"cves":[]},{"id":"0b0cd537-fc77-4e6e-a973-e53495c1083d","title":"Renamed Office Binary Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-12-20","modified":"2025-12-09","description":"Detects the execution of a renamed office binary","references":["https://infosec.exchange/@sbousseaden/109542254124022664"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036.003"],"path":"rules/windows/process_creation/proc_creation_win_renamed_office_processes.yml","techniques":["T1036.003"],"cves":[]},{"id":"0ba1da6d-b6ce-4366-828c-18826c9de23e","title":"Potential Defense Evasion Via Rename Of Highly Relevant Binaries","author":"Matthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113","status":"test","level":"high","date":"2019-06-15","modified":"2026-06-29","description":"Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.","references":["https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html","https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html","https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks","https://twitter.com/christophetd/status/1164506034720952320","https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/","https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036.003","car.2013-05-009"],"path":"rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant.yml","techniques":["T1036.003"],"cves":[]},{"id":"0c92f2e6-f08f-4b73-9216-ecb0ca634689","title":"PUA - Potential PE Metadata Tamper Using Rcedit","author":"Micah Babinski","status":"test","level":"medium","date":"2022-12-11","modified":"2023-03-05","description":"Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.","references":["https://security.stackexchange.com/questions/210843/is-it-possible-to-change-original-filename-of-an-exe","https://www.virustotal.com/gui/file/02e8e8c5d430d8b768980f517b62d7792d690982b9ba0f7e04163cbc1a6e7915","https://github.com/electron/rcedit"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036.003","attack.t1036","attack.t1027.005","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_pua_rcedit_execution.yml","techniques":["T1036.003","T1036","T1027.005","T1027"],"cves":[]},{"id":"0cf2e1c6-8d10-4273-8059-738778f981ad","title":"Potential WerFault ReflectDebugger Registry Value Abuse","author":"X__Junior","status":"test","level":"high","date":"2023-05-18","modified":null,"description":"Detects potential WerFault \"ReflectDebugger\" registry value abuse for persistence.","references":["https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html","https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.stealth","attack.t1036.003"],"path":"rules/windows/registry/registry_set/registry_set_persistence_reflectdebugger.yml","techniques":["T1036.003"],"cves":[]},{"id":"18da1007-3f26-470f-875d-f77faf1cab31","title":"Ps.exe Renamed SysInternals Tool","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-10-22","modified":"2023-05-02","description":"Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report","references":["https://www.us-cert.gov/ncas/alerts/TA17-293A"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.g0035","attack.t1036.003","car.2013-05-009","detection.emerging-threats"],"path":"rules-emerging-threats/2017/TA/Dragonfly/proc_creation_win_apt_ta17_293a_ps.yml","techniques":["T1036.003"],"cves":[]},{"id":"2ddef153-167b-4e89-86b6-757a9e65dcac","title":"File Download Via Bitsadmin To A Suspicious Target Folder","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-28","modified":"2025-12-10","description":"Detects usage of bitsadmin downloading a file to a suspicious target folder","references":["https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin","https://isc.sans.edu/diary/22264","https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/","https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197","attack.s0190","attack.t1036.003","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder.yml","techniques":["T1197","T1036.003","T1105"],"cves":[]},{"id":"30a8cb77-8eb3-4cfb-8e79-ad457c5a4592","title":"Renamed Powershell Under Powershell Channel","author":"Harish Segar, frack113","status":"test","level":"low","date":"2020-06-29","modified":"2025-01-20","description":"Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.\n","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse"],"logsource":{"product":"windows","category":"ps_classic_start"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1036.003"],"path":"rules/windows/powershell/powershell_classic/posh_pc_renamed_powershell.yml","techniques":["T1059.001","T1036.003"],"cves":[]},{"id":"32e280f1-8ad4-46ef-9e80-910657611fbc","title":"Potential Homoglyph Attack Using Lookalike Characters","author":"Micah Babinski, @micahbabinski","status":"test","level":"medium","date":"2023-05-07","modified":null,"description":"Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.\nThis is used as an obfuscation and masquerading techniques. Only \"perfect\" homoglyphs are included; these are characters that\nare indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.\n","references":["https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish","http://www.irongeek.com/homoglyph-attack-generator.php"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","attack.t1036.003"],"path":"rules/windows/process_creation/proc_creation_win_susp_homoglyph_cyrillic_lookalikes.yml","techniques":["T1036","T1036.003"],"cves":[]},{"id":"36480ae1-a1cb-4eaa-a0d6-29801d7e9142","title":"Potential Defense Evasion Via Binary Rename","author":"Matthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades)","status":"test","level":"medium","date":"2019-06-15","modified":"2026-06-05","description":"Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.","references":["https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html","https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html","https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1036.003/T1036.003.md#atomic-test-1---masquerading-as-windows-lsass-process","https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036.003"],"path":"rules/windows/process_creation/proc_creation_win_renamed_binary.yml","techniques":["T1036.003"],"cves":[]},{"id":"4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67","title":"Renamed ProcDump Execution","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2019-11-18","modified":"2026-06-29","description":"Detects the execution of a renamed ProcDump executable.\nThis often done by attackers or malware in order to evade defensive mechanisms.\n","references":["https://learn.microsoft.com/en-us/sysinternals/downloads/procdump"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036.003"],"path":"rules/windows/process_creation/proc_creation_win_renamed_sysinternals_procdump.yml","techniques":["T1036.003"],"cves":[]},{"id":"4eec988f-7bf0-49f1-8675-1e6a510b3a2a","title":"Potential PendingFileRenameOperations Tampering","author":"frack113","status":"test","level":"medium","date":"2023-01-27","modified":"2025-10-07","description":"Detect changes to the \"PendingFileRenameOperations\" registry key from uncommon or suspicious images locations to stage currently used files for rename or deletion after reboot.\n","references":["https://any.run/report/3ecd4763ffc944fdc67a9027e459cd4f448b1a8d1b36147977afaf86bbf2a261/64b0ba45-e7ce-423b-9a1d-5b4ea59521e6","https://devblogs.microsoft.com/scripting/determine-pending-reboot-statuspowershell-style-part-1/","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc960241(v=technet.10)?redirectedfrom=MSDN","https://www.trendmicro.com/en_us/research/21/j/purplefox-adds-new-backdoor-that-uses-websockets.html","https://www.trendmicro.com/en_us/research/19/i/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell.html"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.stealth","attack.t1036.003"],"path":"rules/windows/registry/registry_set/registry_set_susp_pendingfilerenameoperations.yml","techniques":["T1036.003"],"cves":[]},{"id":"4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6","title":"Potential Homoglyph Attack Using Lookalike Characters in Filename","author":"Micah Babinski, @micahbabinski","status":"test","level":"medium","date":"2023-05-08","modified":null,"description":"Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.\nThis is used as an obfuscation and masquerading techniques. Only \"perfect\" homoglyphs are included; these are characters that\nare indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.\n","references":["https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish","http://www.irongeek.com/homoglyph-attack-generator.php"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.stealth","attack.t1036","attack.t1036.003"],"path":"rules/windows/file/file_event/file_event_win_susp_homoglyph_filename.yml","techniques":["T1036","T1036.003"],"cves":[]},{"id":"5b80a791-ad9b-4b75-bcc1-ad4e1e89c200","title":"File With Suspicious Extension Downloaded Via Bitsadmin","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-28","modified":"2023-05-30","description":"Detects usage of bitsadmin downloading a file with a suspicious extension","references":["https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin","https://isc.sans.edu/diary/22264","https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197","attack.s0190","attack.t1036.003","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions.yml","techniques":["T1197","T1036.003","T1105"],"cves":[]},{"id":"8518ed3d-f7c9-4601-a26c-f361a4256a0c","title":"Suspicious Download From File-Sharing Website Via Bitsadmin","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-06-28","modified":"2026-03-29","description":"Detects usage of bitsadmin downloading a file from a suspicious domain","references":["https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin","https://isc.sans.edu/diary/22264","https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker","https://www.cisa.gov/uscert/ncas/alerts/aa22-321a","https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197","attack.s0190","attack.t1036.003","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_bitsadmin_download_file_sharing_domains.yml","techniques":["T1197","T1036.003","T1105"],"cves":[]},{"id":"8a4519e8-e64a-40b6-ae85-ba8ad2177559","title":"Renamed BrowserCore.EXE Execution","author":"Max Altgelt (Nextron Systems)","status":"test","level":"high","date":"2022-06-02","modified":"2023-02-03","description":"Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)","references":["https://twitter.com/mariuszbit/status/1531631015139102720"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.stealth","attack.t1528","attack.t1036.003"],"path":"rules/windows/process_creation/proc_creation_win_renamed_browsercore.yml","techniques":["T1528","T1036.003"],"cves":[]},{"id":"96036718-71cc-4027-a538-d1587e0006a7","title":"Windows Processes Suspicious Parent Directory","author":"vburov","status":"test","level":"low","date":"2019-02-23","modified":"2025-03-06","description":"Detect suspicious parent processes of well-known Windows processes","references":["https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2","https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/","https://www.13cubed.com/downloads/windows_process_genealogy_v2.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036.003","attack.t1036.005"],"path":"rules/windows/process_creation/proc_creation_win_susp_proc_wrong_parent.yml","techniques":["T1036.003","T1036.005"],"cves":[]},{"id":"99c840f2-2012-46fd-9141-c761987550ef","title":"Suspicious Download From Direct IP Via Bitsadmin","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-06-28","modified":"2023-02-15","description":"Detects usage of bitsadmin downloading a file using an URL that contains an IP","references":["https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin","https://isc.sans.edu/diary/22264","https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/","https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197","attack.s0190","attack.t1036.003"],"path":"rules/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip.yml","techniques":["T1197","T1036.003"],"cves":[]},{"id":"9d4548fa-bba0-4e88-bd66-5d5bf516cda0","title":"Masquerading as Linux Crond Process","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2019-10-21","modified":"2023-08-22","description":"Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.\nSeveral different variations of this technique have been observed.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/8a82e9b66a5b4f4bc5b91089e9f24e0544f20ad7/atomics/T1036.003/T1036.003.md#atomic-test-2---masquerading-as-linux-crond-process"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.stealth","attack.t1036.003"],"path":"rules/linux/auditd/execve/lnx_auditd_masquerading_crond.yml","techniques":["T1036.003"],"cves":[]},{"id":"b471f462-eb0d-4832-be35-28d94bdb4780","title":"Remote Access Tool - Renamed MeshAgent Execution - Windows","author":"Norbert Jaśniewicz (AlphaSOC)","status":"experimental","level":"high","date":"2025-05-19","modified":null,"description":"Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.\nRMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.\nHowever, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.\n","references":["https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access","https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/","https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/","https://www.security.com/threat-intelligence/medusa-ransomware-attacks"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.stealth","attack.t1219.002","attack.t1036.003"],"path":"rules/windows/process_creation/proc_creation_win_remote_access_tools_renamed_meshagent_execution.yml","techniques":["T1219.002","T1036.003"],"cves":[]},{"id":"bd1c6866-65fc-44b2-be51-5588fcff82b9","title":"Renamed Msdt.EXE Execution","author":"pH-T (Nextron Systems)","status":"test","level":"high","date":"2022-06-03","modified":"2023-02-03","description":"Detects the execution of a renamed \"Msdt.exe\" binary","references":["https://lolbas-project.github.io/lolbas/Binaries/Msdt/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036.003"],"path":"rules/windows/process_creation/proc_creation_win_renamed_msdt.yml","techniques":["T1036.003"],"cves":[]},{"id":"bd3b5eaa-439d-4a42-8f35-a49f5c8a2582","title":"Remote Access Tool - Renamed MeshAgent Execution - MacOS","author":"Norbert Jaśniewicz (AlphaSOC)","status":"experimental","level":"high","date":"2025-05-19","modified":null,"description":"Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.\nRMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.\nHowever, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.\n","references":["https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access","https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/","https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/","https://www.security.com/threat-intelligence/medusa-ransomware-attacks"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.command-and-control","attack.stealth","attack.t1219.002","attack.t1036.003"],"path":"rules/macos/process_creation/proc_creation_macos_remote_access_tools_renamed_meshagent_execution.yml","techniques":["T1219.002","T1036.003"],"cves":[]},{"id":"d059842b-6b9d-4ed1-b5c3-5b89143c6ede","title":"File Download Via Bitsadmin","author":"Michael Haag, FPT.EagleEye","status":"test","level":"medium","date":"2017-03-09","modified":"2023-02-15","description":"Detects usage of bitsadmin downloading a file","references":["https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin","https://isc.sans.edu/diary/22264","https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197","attack.s0190","attack.t1036.003","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml","techniques":["T1197","T1036.003","T1105"],"cves":[]},{"id":"edd8a48c-1b9f-4ba1-83aa-490338cd1ccb","title":"Renamed Jusched.EXE Execution","author":"Markus Neis, Swisscom","status":"test","level":"high","date":"2019-06-04","modified":"2023-02-03","description":"Detects the execution of a renamed \"jusched.exe\" as seen used by the cobalt group","references":["https://www.bitdefender.com/files/News/CaseStudies/study/262/Bitdefender-WhitePaper-An-APT-Blueprint-Gaining-New-Visibility-into-Financial-Threats-interactive.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1036.003"],"path":"rules/windows/process_creation/proc_creation_win_renamed_jusched.yml","techniques":["T1036.003"],"cves":[]},{"id":"f5d19838-41b5-476c-98d8-ba8af4929ee2","title":"LOL-Binary Copied From System Directory","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-08-29","modified":"2025-11-27","description":"Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations.\n","references":["https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120","https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html","https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/","https://www.virustotal.com/gui/file/14e722855605ba78dc1d21153f0e1be90e7528149f2cd2d7d6eba8ef27534bdc/behavior"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036.003"],"path":"rules/windows/process_creation/proc_creation_win_susp_copy_system_dir_lolbin.yml","techniques":["T1036.003"],"cves":[]},{"id":"f91e51c9-f344-4b32-969b-0b6f6b8537d4","title":"Renamed Schtasks Execution","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-27","modified":null,"description":"Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks.\nOne of the very common persistence techniques is schedule malicious tasks using schtasks.exe.\nSince, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.\n","references":["https://x.com/JangPr0/status/1932034543026065833","https://ss64.com/nt/schtasks.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1036.003","attack.t1053.005"],"path":"rules/windows/process_creation/proc_creation_win_renamed_schtasks_execution.yml","techniques":["T1036.003","T1053.005"],"cves":[]},{"id":"fff9d2b7-e11c-4a69-93d3-40ef66189767","title":"Suspicious Copy From or To System Directory","author":"Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2020-07-03","modified":"2026-03-16","description":"Detects a suspicious copy operation that tries to copy a program from system (System32, SysWOW64, WinSxS) directories to another on disk.\nOften used to move LOLBINs such as 'certutil' or 'desktopimgdownldr' to a different location with a different name in order to bypass detections based on locations.\n","references":["https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120","https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html","https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036.003"],"path":"rules/windows/process_creation/proc_creation_win_susp_copy_system_dir.yml","techniques":["T1036.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}