Analytics BIOC Informational
✕

Execution of renamed lolbin

An attacker may be trying to avoid detection of lolbin's execution using a renamed lolbin.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Masquerading (T1036) Masquerading: Rename Legitimate Utilities (T1036.003)
Detector tags: EDR Windows Disguised Processes
Attacker's goals:

Detection avoidance via file rename.

Investigative actions:

Check the lolbin's origin or whether it comes with any packages the user has used.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Execution of significantly renamed lolbin Medium (parent: Informational)