Cross-source coverage

T1036.005 / ATT&CK

Masquerading: Match Legitimate Resource Name or Location

60 rules · 59 families across 5 sources.

1 atomic-IOC hidden · include

From MITRE ATT&CK 19.2

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.

Tactics
Stealth
Platforms
Containers · ESXi · Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLlinux:osquerymacos:unifiedlogfs:fsusagekubernetes:apiservercontainerd:eventsesxi:vmkernelesxi:hostd

How MITRE says to detect it DET0347

Detection Strategy for Masquerading via Legitimate Resource Name or Location

Windows Analytic 0983

Detects processes or binaries executed from trusted directories (e.g., System32) or using trusted names (e.g., svchost.exe) where the metadata, hash, or parent process does not align with legitimate activity patterns.

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Sysmon EventCode=11

Linux Analytic 0984

Detects renamed binaries or scripts placed into trusted paths like /usr/bin or /lib with mismatched metadata or unexpected creation/modification times.

  • auditd:SYSCALL execve
  • auditd:SYSCALL open
  • auditd:SYSCALL rename
  • linux:osquery Filesystem modifications to trusted paths

macOS Analytic 0985

Detects binaries or launch daemons in /System/Library or /Applications with mismatched bundle names, unexpected metadata, or improper installation origin.

  • macos:unifiedlog log collect from launchd and process start
  • fs:fsusage filesystem monitoring of exec/open

Containers Analytic 0986

Detects malicious containers or pods using names, labels, or namespaces that mimic legitimate workloads; also checks for image layer mismatches and unauthorized resource deployments.

  • kubernetes:apiserver Resource creation and update logs
  • containerd:events Docker or containerd image pulls and process executions

ESXi Analytic 0987

Detects VIBs, scripts, or binaries placed into directories like /bin or /etc/vmware with names mimicking standard ESXi components. Also monitors unauthorized creation of services.

  • esxi:vmkernel Exec
  • esxi:vmkernel module load
  • esxi:hostd Service events
  • esxi:hostd task creation events

View on attack.mitre.org ↗

elastic/detection-rules

25 rules
Detection Severity Format
Executable Masquerading as Kernel Process High Elastic TOML
Potential CVE-2025-33053 Exploitation High Elastic TOML
Potential Masquerading as Svchost High Elastic TOML
Potential Masquerading as System32 DLL High Elastic TOML
Potential Microsoft Office Sandbox Evasion High Elastic TOML
Potential Privilege Escalation via InstallerFileTakeOver High Elastic TOML
Potential Process Name Stomping with Prctl High Elastic TOML
Process Started from Process ID (PID) File High Elastic TOML
Suspicious Microsoft Antimalware Service Execution High Elastic TOML
UAC Bypass Attempt via Windows Directory Masquerading High Elastic TOML

+ 15 more from elastic/detection-rules → showing the 10 highest-severity

SigmaHQ/sigma

20 rules
Detection Severity Format
Exploit for CVE-2015-1641 Critical Sigma
Greenbug Espionage Group Indicators Critical Sigma
RedSun - TieringEngineService.exe Detected as EICAR Test File Critical Sigma
RedSun - TieringEngineService.exe Staged in RS-Prefixed Temp Dir Critical Sigma
Lazarus System Binary Masquerading High Sigma
Potential MsiExec Masquerading High Sigma
RedSun - Conhost.exe Spawned by TieringEngineService.exe High Sigma
Scheduled Task Creation Masquerading as System Processes High Sigma
Small Sieve Malware File Indicator Creation High Sigma
Suspicious Process Masquerading As SvcHost.EXE High Sigma

+ 10 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/protections-artifacts

7 rules
Detection Severity Format
Malicious Ledger Live Execution Undefined Elastic TOML
Persistence via a Masqueraded Plist Filename Undefined Elastic TOML
Potential Masquerading via /proc/self/exe Undefined Elastic TOML
Suspicious Binary Execution via Path Alias Undefined Elastic TOML
Suspicious Executable Copied from Volume Mount Undefined Elastic TOML
Suspicious Scheduled Task Creation via Masqueraded XML File Undefined Elastic TOML
Unusual File Written or Modified in Startup Folder Undefined Elastic TOML

splunk/security_content

6 rules
Detection Severity Format
Attacker Tools On Endpoint Undefined SPL
Windows LOLBAS Executed Outside Expected Path Undefined SPL
Windows MSC EvilTwin Directory Path Manipulation Undefined SPL
Windows Process Execution From ProgramData Undefined SPL
Windows Process Execution in Temp Dir Undefined SPL
Windows Suspicious Process File Path Undefined SPL

socfortress/Wazuh-Rules

2 rules
Detection Severity Format
Execution from a suspicious '...' directory (Masquerading - T1036.005) High Wazuh XML
Suspicious shell launched from a masquerading '...' directory (T1036.005) High Wazuh XML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.