Skip to content
Sign In
Learn

T1036.003

Rename System Utilities

What it is

Attackers copy a legitimate utility, such as a script host, an archiver or a remote administration tool, and run the copy under a different name, so that rules and allow lists that match on the program's name miss it. It is a sub-technique of Masquerading.

The copy is byte for byte the original program. Only the name on disk has changed: the name compiled into the program, its signature and its file hash still say what it really is, and that is what gives the disguise away.

How adversaries use it

The attacker copies the utility out of its usual folder, often into a temporary or other user-writable folder, renames it, and runs it with the same arguments it always takes. The new name might be random, very short, or chosen to look harmless. Tools that watch for the utility by name, and analysts scanning a process list, see an unfamiliar or innocent name, while the command line still carries the utility's own switches.

Detect it in Elastic

Data source: Windows process creation events (Sysmon and Elastic Defend), with Sysmon's file creation events for the copy

Key fields

event.code: 1 (Sysmon) when a process starts process.name: the name the copy ran under process.pe.original_file_name: the name compiled into the program, which a rename does not change; Sysmon and Elastic Defend record it, Windows Security's 4688 does not process.executable: where the copy ran from process.hash.sha256: the same hash as the original utility, where hashes are recorded process.parent.name: what started it event.code: 11 (Sysmon) when the copy is written, with file.path host.name, @timestamp

Example event

{
  "host": {
    "name": "ws-529.corp.example"
  },
  "user": {
    "name": "m.castell"
  },
  "event": {
    "code": "1"
  },
  "process": {
    "pe": {
      "original_file_name": "cscript.exe"
    },
    "name": "svcmon.exe",
    "parent": {
      "name": "wscript.exe"
    },
    "executable": "E:\\Depot\\svcmon.exe"
  },
  "@timestamp": "2026-06-09T10:15:42.318Z"
}

Prebuilt Elastic rule: Renamed Utility Executed with Short Program Name

Hunt guidance

Compare the two names. Take the process starts that carry the compiled-in name, process.pe.original_file_name: *, and lay them out by process.pe.original_file_name and process.name side by side. Most pairs match, apart from letter case; read the ones that do not. A utility's original name next to a different running name, especially from a temporary, user or removable folder, is the finding.

Where the compiled-in name is missing, as in Windows Security's 4688 events, fall back on the hash: a known utility's hash running under another name or path is the same finding. The copy is also written to disk before it runs, so a file creation event for a program in a user folder, followed soon after by a start from that path, adds context.

The prebuilt rule named on this page fires only when the copy is given a one-character name and the compiled-in name is recorded, so a copy renamed to anything longer is this hunt's to find.

Ruling out legitimate activity

Some legitimate software ships renamed copies of common tools, and installers often unpack and run helpers under temporary names. Some programs also carry a compiled-in name that differs from their file name for harmless reasons, such as a vendor's naming habits or letter case. Check whether the path belongs to installed software and whether the parent is that software's installer or updater. A system utility's original name running from a temporary or user folder, under a name it never ships with, is rarely legitimate.

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

References

Practice it

No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.