tfMITRE ATT&CK sub-technique

Match Legitimate Resource Name or Location T1036.005

Tactic: Stealth
Platforms: Containers, ESXi, Linux, macOS, Windows
Version: 3.0
Created: 10 February 2020
Last modified: 12 May 2026
Contributors: Vishwas Manral, McAfee; Yossi Weizman, Azure Defender Research Team

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 1%

Threat groups99th percentile · 99% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 1%

Campaigns99th percentile · 99% of ATT&CK techniques have this many campaigns recorded or fewer.

143

Tools & malwareTop 2%

Tools & malware98th percentile · 98% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 10%

Detection rules90th percentile · 90% of ATT&CK techniques have this many detection rules written or fewer.

Match Legitimate Resource Name or Location MITRE reference T1036.005

Top 1%of all ATT&CK techniques for number of groups

63 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ShinyHuntersG1057 ↗

Has disguised MeshCentral agent binaries as Microsoft Azure services, e.g. meshagent32-azure-ops.exe, meshagent64-azure-ops.exe, and meshagent64-v2.exe.1

created 2026-07-291 referenceaka UNC6240

TeamPCPG1056 ↗

Has cloned GitHub commit metadata including the author name, email, committer, and timestamps to use for impostor commits.1 TeamPCP has also used legitimate file names such as msbuild.exe and ringtone.wav to mask malicious payloads.2 3

created 2026-07-163 referencesaka PCPCat

VOID MANTICOREG1055 ↗

Has masqueraded malicious payloads to resemble legitimate applications.1 2 VOID MANTICORE has leveraged malicious payloads that use nomenclature associated with common applications that include Pictory, KeePass, WhatsApp, and Telegram.2

created 2026-04-203 referencesaka COBALT MYSTIQUE

Velvet AntG1047 ↗

Used a malicious DLL, iviewers.dll, that mimics the legitimate "OLE/COM Object Viewer" within Windows.1

created 2025-03-141 reference

Storm-1811G1046 ↗

Has disguised Cobalt Strike installers as a malicious DLL masquerading as part of a legitimate 7zip installation package.1

created 2025-03-141 reference

APT42G1044 ↗

Has masqueraded the VINETHORN payload as a VPN application.1

created 2025-01-081 reference

All 63 groups for this technique · 6 newest in this preview

15 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

2025 Poland Wiper AttacksC0063 ↗

During the 2025 Poland Wiper Attacks, the adversaries created rules that mimicked the name of an institution already present in the network device configuration to avoid detection.1

2025

RedPenguinC0056 ↗

During RedPenguin, UNC3886 created multiple strains of malware using names to mimic legitimate binaries such as appid, to, irad, lmpad, jdosd, and oemd.1

2024–2025

Operation Digital EyeC0061 ↗

During Operation Digital Eye, threat actors attempted to make filenames appear legitimate by tailoring them to the victim organization.1

2024

J-magic CampaignC0050 ↗

During the J-magic Campaign, threat actors used the name “JunoscriptService” to masquerade malware as the Junos automation scripting service.1

2023–2024

C0018C0018 ↗

For C0018, the threat actors renamed a Sliver payload to vmware_kb.exe.1

2022

C0017C0017 ↗

During C0017, APT41 used file names beginning with USERS, SYSUSER, and SYSLOG for DEADEYE, and changed KEYPLUG file extensions from .vmp to .upx likely to avoid hunting detections.1

2021–2022

All 15 campaigns for this technique · 6 newest in this preview

Offense vs defense T1036.005

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 15Sigma rules (cumulative) · 21Splunk ESCU (cumulative) · 6

first rule: 2017 Q3 · 15 of 15 campaigns plotted

Match Legitimate Resource Name or Location detection strategy DET0347

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Masquerading via Legitimate Resource Name or Location

Enterprise

5 platforms

AN0983 · Windows

Detects processes or binaries executed from trusted directories (e.g., System32) or using trusted names (e.g., svchost.exe) where the metadata, hash, or parent process does not align with legitimate activity patterns.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
File CreationDC0039	WinEventLog:Sysmon	EventCode=11

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
trusted_directory_list	Paths such as C:\Windows\System32 that adversaries may abuse
process_baseline_age	Time window to determine process novelty (e.g., 30 days)

AN0984 · Linux

Detects renamed binaries or scripts placed into trusted paths like /usr/bin or /lib with mismatched metadata or unexpected creation/modification times.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process ModificationDC0020	auditd:SYSCALL	rename
Process CreationDC0032	auditd:SYSCALL	execve
File AccessDC0055	auditd:SYSCALL	open
File MetadataDC0059	linux:osquery	Filesystem modifications to trusted paths

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
monitored_paths	Set of system or application directories considered sensitive or trusted
hash_validation_window	Timeframe during which a newly created file should have its hash validated (e.g., within 5 minutes of write)

AN0985 · macOS

Detects binaries or launch daemons in /System/Library or /Applications with mismatched bundle names, unexpected metadata, or improper installation origin.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process MetadataDC0034	macos:unifiedlog	log collect from launchd and process start
File MetadataDC0059	fs:fsusage	filesystem monitoring of exec/open

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
expected_bundle_names	List of known application names and paths to validate against
signed_by_apple_check	Toggle to enforce checks for Apple-signed binaries in trusted directories

AN0986 · Containers

Detects malicious containers or pods using names, labels, or namespaces that mimic legitimate workloads; also checks for image layer mismatches and unauthorized resource deployments.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Image MetadataDC0028	kubernetes:apiserver	Resource creation and update logs
Process MetadataDC0034	containerd:events	Docker or containerd image pulls and process executions

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
trusted_namespace_list	List of namespaces that should not be used by unprivileged users or workloads
image_baseline_hashes	Reference hashes of approved container images

AN0987 · ESXi

Detects VIBs, scripts, or binaries placed into directories like /bin or /etc/vmware with names mimicking standard ESXi components. Also monitors unauthorized creation of services.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Scheduled Job CreationDC0001	esxi:hostd	task creation events
Module LoadDC0016	esxi:vmkernel	module load
Process CreationDC0032	esxi:vmkernel	Exec
Service MetadataDC0041	esxi:hostd	Service events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
esxi_baseline_file_list	Known good binaries and their expected paths
service_creation_alert_threshold	Threshold for unknown service names or mismatched digital signatures

1 analytic

Masquerading (T1036) is defined by ATT&CK as follows:

TypeTTPCoverageModerateSubmitted2021

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	image_path
process	access	exe
process	access	image_path
process	terminate	exe
process	terminate	image_path

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Looks for mismatches between process names and their image paths.

processes = search Process:*
suspicious_processes = filter processes where (
  (exe=svchost.exe AND (image_path!="C:\\Windows\\System32\\svchost.exe" OR process_path!="C:\\Windows\\SysWow64\\svchost.exe"))
  OR (exe=smss.exe AND image_path!="C:\\Windows\\System32\\smss.exe")
  OR (exe=wininit.exe AND image_path!="C:\\Windows\\System32\\wininit.exe")
  OR (exe=taskhost.exe AND image_path!="C:\\Windows\\System32\\taskhost.exe")
  OR (exe=lasass.exe AND image_path!="C:\\Windows\\System32\\lsass.exe")
  OR (exe=winlogon.exe AND image_path!="C:\\Windows\\System32\\winlogon.exe")
  OR (exe=csrss.exe AND image_path!="C:\\Windows\\System32\\csrss.exe")
  OR (exe=services.exe AND image_path!="C:\\Windows\\System32\\services.exe")
  OR (exe=lsm.exe AND image_path!="C:\\Windows\\System32\\lsm.exe")
  OR (exe=explorer.exe AND image_path!="C:\\Windows\\explorer.exe")
  )
output suspicious_processes

Splunk search version of the above pseudocode.

index=__your_sysmon_index__ source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" AND (
(process_name=svchost.exe AND NOT (process_path="C:\\Windows\\System32\\svchost.exe" OR process_path="C:\\Windows\\SysWow64\\svchost.exe"))
OR (process_name=smss.exe AND NOT process_path="C:\\Windows\\System32\\smss.exe")
OR (process_name=wininit.exe AND NOT process_path="C:\\Windows\\System32\\wininit.exe")
OR (process_name=taskhost.exe AND NOT process_path="C:\\Windows\\System32\\taskhost.exe")
OR (process_name=lasass.exe AND NOT process_path="C:\\Windows\\System32\\lsass.exe")
OR (process_name=winlogon.exe AND NOT process_path="C:\\Windows\\System32\\winlogon.exe")
OR (process_name=csrss.exe AND NOT process_path="C:\\Windows\\System32\\csrss.exe")
OR (process_name=services.exe AND NOT process_path="C:\\Windows\\System32\\services.exe")
OR (process_name=lsm.exe AND NOT process_path="C:\\Windows\\System32\\lsm.exe")
OR (process_name=explorer.exe AND NOT process_path="C:\\Windows\\explorer.exe")
)

Code SigningM1045

Require signed binaries and images.

Execution PreventionM1038

Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.

Restrict File and Directory PermissionsM1022

Use file system access controls to protect folders such as C:\Windows\System32.

Tests3ExecutorsPowerShell 2 · sh 1Need elevation1 of 3Have prerequisites1Have cleanup3Platformsmacos, linux, windows

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Execute a process from a directory masquerading as the current parent directory macos, linux sh — — Yes

Create and execute a process from a directory masquerading as the current parent directory (... instead of normal ..)

Input arguments

Name	Type	Default	Description
test_message	string	Hello from the Atomic Red Team test T1036.005#1	Test message to echo out to the screen

Attack command

mkdir $HOME/...
cp $(which sh) $HOME/...
$HOME/.../sh -c "echo #{test_message}"

Cleanup command

rm -f $HOME/.../sh
rmdir $HOME/.../

GUIDc9f4d590-ab8e-4085-ae6a-d60f41a4d1a6

02 Masquerade as a built-in system executable windows PowerShell — — Yes

Launch an executable that attempts to masquerade as a legitimate executable.

Input arguments

Name	Type	Default	Description
executable_filepath	string	$Env:windir\Temp\svchost.exe	File path where the generated executable will be dropped and executed from. The filename should be the name of a built-in system utility.

Attack command

Add-Type -TypeDefinition @'
public class Test {
    public static void Main(string[] args) {
        System.Console.WriteLine("tweet, tweet");
    }
}
'@ -OutputAssembly "#{executable_filepath}"

Start-Process -FilePath "#{executable_filepath}"

Cleanup command

Remove-Item -Path "#{executable_filepath}" -ErrorAction Ignore

GUID62b75d54-f21f-4b28-a618-a19346760229

03 Masquerading cmd.exe as VEDetector.exe windows PowerShell Required 1 Yes

This test simulates an adversary renaming cmd.exe to VEDetector.exe to masquerade as a legitimate application. The test copies cmd.exe, renames it to VEDetector.exe, adds a registry run key for persistence, and executes the renamed binary. This technique may be used to evade detection by mimicking legitimate software names or locations. **Expected Output:** - A new process named VEDetector.exe appears in the process list, but its behavior matches cmd.exe. - SIEM/EDR systems may detect this as suspicious process activity (e.g., Sysmon Event ID 1 for process creation, or Event ID 13 for registry modifications). - Registry modification in HKLM:\Software\Microsoft\Windows\CurrentVersion\Run may trigger persistence alerts in XDR platforms. **References:** - MITRE ATT&CK T1036.005 - Sysmon Process Creation

Input arguments

Name	Type	Default	Description
ved_path	Path	$env:TEMP	Directory path where VEDetector.exe will be created
source_file	Path	$env:SystemRoot\System32\cmd.exe	Path to the source cmd.exe file

Attack command

# Copy and rename cmd.exe to VEDetector.exe
Copy-Item -Path "#{source_file}" -Destination "#{ved_path}\VEDetector.exe" -Force

# Create registry run key for persistence
New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "VEDetector" -Value "#{ved_path}\VEDetector.exe" -PropertyType String -Force

# Start the renamed process
Start-Process -FilePath "#{ved_path}\VEDetector.exe"

Start-Sleep -Seconds 5

Cleanup command

# Remove registry key
Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "VEDetector" -ErrorAction SilentlyContinue

# Stop the process
Stop-Process -Name "VEDetector" -Force -ErrorAction SilentlyContinue

# Remove the file
Remove-Item -Path "#{ved_path}\VEDetector.exe" -Force -ErrorAction SilentlyContinue

Write-Host "[+] Cleaned up VEDetector artifacts"

Prerequisite

The source cmd.exe file must exist on the system.

Check

if (Test-Path "#{source_file}") { exit 0 } else { exit 1 }

Satisfy

Write-Host "[-] Source file not found: #{source_file}. Ensure cmd.exe exists in the specified path."
exit 1

GUIDb879ac0c-219e-43b7-b13e-123d6e5ef0b9

Tests from Atomic Red Team (MIT licence) · technique definition

Match Legitimate Resource Name or Location detections T1036.005

27 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 10%of all ATT&CK techniques for number of rules

Product

(none) 1

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs