CmdID

CmdID / Techniques / T1036

T1036.005 Masquerading: Match Legitimate Resource Name or Location

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. MITRE ATT&CK

4 programs on CmdID 14 Sigma rules T1036.005 on attack.mitre.org

Part of

MITRE ATT&CK
T1036Masquerading

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
colorcpl.exeCopyconhost.exeits Sigma rulesmsiexec.exeits Sigma ruleswsl.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
criticalExploit for CVE-2015-1641Florian Roth (Nextron Systems) · Windows
criticalGreenbug Espionage Group IndicatorsFlorian Roth (Nextron Systems) · Windows
highLazarus System Binary MasqueradingTrent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1) · Windows
highPotential MsiExec MasqueradingFlorian Roth (Nextron Systems) · Windows
highRedSun - Conhost.exe Spawned by TieringEngineService.exeSwachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost · Windows
highScheduled Task Creation Masquerading as System ProcessesSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highSuspicious Process Masquerading As SvcHost.EXESwachchhanda Shrawan Poudel · Windows
highSuspicious WSL Binary Hijack via Proxy ExecutionSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highSuspicious WSL Binary MasqueradingSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highUncommon Svchost Command Line ParameterLiran Ravich · Windows
mediumPotential Binary Impersonating Sysinternals Toolsfrack113, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumSuspicious Scheduled Task Creation via Masqueraded XML FileSwachchhanda Shrawan Poudel, Elastic (idea) · Windows
mediumUncommon Svchost Parent ProcessFlorian Roth (Nextron Systems) · Windows
lowWindows Processes Suspicious Parent Directoryvburov · Windows