What MITRE ATT&CK T1036.003: Rename Legitimate Utilities (Enterprise Tactic TA0005 - Defense Evasion) requires
MITRE ATT&CK T1036.003 (Rename Legitimate Utilities) is an Enterprise Defense Evasion sub-technique of T1036 (Masquerading). Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). Affected platforms: Linux, macOS, Windows. MITRE-documented mitigations include M1022 Restrict File and Directory Permissions. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-06, CA-07, CM-02, CM-06, CM-07, IA-09.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1036/003/
SHA-256 integrity: 2241627de877d97e0c996702877f25dd6a554c265fdcc3f4429bc790e4b86485
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1036.003: Rename Legitimate Utilities (https://attack.mitre.org/techniques/T1036/003/)
- MITRE ATT&CK Tactic TA0005: Defense Evasion (https://attack.mitre.org/tactics/TA0005/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-attack-t1036-003-rename-system-utilities.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-attack-t1036-003-rename-system-utilities.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-attack-t1036-003-rename-system-utilities
- Back to registry: Browse all 10,085 compliance nodes