Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. [1] It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). [2] An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths. [3]
| ID | Name | Description |
|---|---|---|
| G0050 | APT32 |
APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection.[4] |
| S0046 | CozyCar |
The CozyCar dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file.[3] |
| G1034 | Daggerfly |
Daggerfly used a renamed version of rundll32.exe, such as "dbengin.exe" located in the |
| S1111 | DarkGate |
DarkGate executes a Windows Batch script during installation that creases a randomly-named directory in the |
| G0093 | GALLIUM | |
| S1020 | Kevin |
Kevin has renamed an image of |
| G0032 | Lazarus Group |
Lazarus Group has renamed system utilities such as |
| G0045 | menuPass |
menuPass has renamed certutil and moved it to a different location on the system to avoid detection based on use of the tool.[10] |
| ID | Mitigation | Description |
|---|---|---|
| M1022 | Restrict File and Directory Permissions |
Use file system access controls to protect folders such as C:\Windows\System32. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments that may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. |
| DS0022 | File | File Metadata |
Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. |
| File Modification |
Monitor for changes made to files for unexpected modifications to file names that are mismatched between the file name on disk and that of the binary's PE metadata. This is a likely indicator that a binary was renamed after it was compiled. Note: There are no standard Windows events for file modification. However, Event ID 4663 (An attempt was made to access an object) can be used to audit and alert on attempts to access system utility binaries; the "Accesses" field can be used to filter by type of access (e.g., MODIFY vs DELETE). |
||
| DS0009 | Process | Process Metadata |
Monitor for file names that are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. |