Command Line
mv /usr/bin/[FILE] /usr/bin/[NEWNAME]
Description
Attackers will often utilize mv to copy and rename executables in attempts to avoid string-based detection solutions using the original file name.
Risk
Low
Risk Reason
This is an extremely common activity with little negative impact other than recon purposes.
Fidelity
Low
Fidelity Reason
It would be extremely difficult to alert on this type of activity with a high fidelity - perhaps alerting just on the rename of system files.
Operating Systems
Killchain Phases
References
MITRE ATT&CK TECHNIQUES
URL: https://attack.mitre.org/techniques/T1036/003
Description: Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. (Citation: LOLBAS Main Site) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). (Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths. (Citation: F-Secure CozyDuke)
Tactics: