Rename Legitimate Utilities
Subtechnique · ATTACK:enterprise:T1036.003
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1036.003",
"title": "Rename Legitimate Utilities",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1036/003",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b",
"external_id": "T1036.003",
"domain": "enterprise",
"created": "2020-02-10T20:03:11.691Z",
"modified": "2026-05-12T15:12:00.713Z",
"version": "3.0",
"aliases": [
],
"tactics": [
"stealth"
],
"source_references": [
{
"source_name": "Elastic Masquerade Ball",
"url": "https://www.elastic.co/blog/how-hunt-masquerade-ball"
},
{
"source_name": "F-Secure CozyDuke",
"url": "https://www.f-secure.com/documents/996508/1030745/CozyDuke"
},
{
"source_name": "LOLBAS Main Site",
"url": "https://lolbas-project.github.io/"
},
{
"source_name": "Huntress Python Malware 2025",
"url": "https://www.huntress.com/blog/snakes-on-a-domain-an-analysis-of-a-python-malware-loader"
},
{
"source_name": "Splunk Detect Renamed PSExec",
"url": "https://research.splunk.com/endpoint/683e6196-b8e8-11eb-9a79-acde48001122/"
},
{
"source_name": "The DFIR Report AutoHotKey 2023",
"url": "https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/"
}
]
}Explicit source assertions (13)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:T1036.003 → subtechnique-of → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b24b8de-944d-49ea-a15f-cb732aeb31de
ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36eb9498-c6eb-4cdc-bbb0-274135fe03a1
Google UNC5221 Ivanti January 2025ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3971fa3e-6ed3-4bc0-84d6-115431ac8d96
DCSO StrelaStealer 2022ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5151bd6c-fb42-49da-9c97-f32a33a505a1
FireEye APT10 Sept 2018ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6441d8c3-861f-4ce3-9121-809d2b0d173b
Qualys LolZarusATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70c290d2-6dfc-47bf-9901-c320798989fb
Trellix Darkgate 2023ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d9f1d6f-2ac8-4346-9810-c0a8582f3e2e
Symantec Daggerfly 2023ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9932d0d8-ad06-4a4f-8acf-1502c2b5f009
Twitter ItsReallyNick APT32 pubprn MasqueradeATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9baf7b65-eec4-46a6-8e4a-1b8a665a288d
1 - appvATTACK:enterprise:S0046 → uses → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4a49b56-e220-4a81-a0da-43b63c012cfe
F-Secure CozyDukeATTACK:enterprise:S1020 → uses → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d04af539-cfb6-4662-8d5a-82dc85cfab1b
Kaspersky Lyceum October 2021ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec56fe4c-c61c-45e3-82fb-44edd43540fc
ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8517b42-4d52-417a-a5dc-cbfb2a31930b
Cybereason Soft Cell June 2019