Analytics BIOC Informational
✕

Execution of masqueraded third-party utility

An attacker may be trying to avoid detection of third-party utility execution by renaming it.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Masquerading (T1036) Masquerading: Rename Legitimate Utilities (T1036.003)
Detector tags: EDR Windows Disguised Processes
Attacker's goals:

Detection avoidance via file masquerading.

Investigative actions:

Check the process origin or whether it comes with any packages the user has used.

Test period:
N/A (single event)
Deduplication:
1 Day
2 variations:
  • Execution of masqueraded third-party automation utility Medium (parent: Informational)
  • Execution of significantly masqueraded third-party utility Low (parent: Informational)