APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection.^[7]

APT38 has renamed system utilities, such asrundll32.exe andmshta.exe, to avoid detection.^[8]

TheCozyCar dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file.^[6]

Daggerfly used a renamed version of rundll32.exe, such as "dbengin.exe" located in theProgramData\Microsoft\PlayReady directory, to proxy malicious DLL execution.^[9]

DarkGate executes a Windows Batch script during installation that creases a randomly-named directory in theC:\ root directory that copies and renames the legitimate Windowscurl command to this new location.^[10]

GALLIUM used a renamed cmd.exe file to evade detection.^[11]

Kevin has renamed an image ofcmd.exe with a random name followed by a.tmpl extension.^[12]

Lazarus Group has renamed system utilities such aswscript.exe andmshta.exe.^[13]

menuPass has renamedcertutil and moved it to a different location on the system to avoid detection based on use of the tool.^[14]

StrelaStealer has used a renamed, legitimatemsinfo32.exe executable to sideload theStrelaStealer payload during initial installation.^[15]

Use file system access controls to protect folders such asC:\Windows\System32.

Execution of binaries where the on-disk filename does not match PE metadata such as OriginalFilename or InternalName. Often observed with renamed LOLBAS or system binaries like rundll32, powershell, or psexec.

Execution of renamed or relocated native macOS utilities with uncommon names or non-default paths (e.g., renamedosascript,bash, orcurl).

Execution of renamed common utilities (e.g.,bash,nc,python,sh) from atypical directories or with names intended to deceive defenders or EDRs.