T1036 Masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. MITRE ATT&CK

8 programs on CmdID 35 Sigma rules T1036 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1036.002Masquerading: Right-to-Left Override

T1036.003Masquerading: Rename Legitimate Utilities

T1036.004Masquerading: Masquerade Task or Service

T1036.005Masquerading: Match Legitimate Resource Name or Location

T1036.006Masquerading: Space after Filename

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

createdump.exeits Sigma rules diantz.exeExecute dumpminitool.exeits Sigma rules findstr.exeits Sigma rules makecab.exeExecute msbuild.exeExecute msdt.exeits Sigma rules procdump.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

highCreateDump Process DumpFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

highForfiles.EXE Child Process MasqueradingNasreddine Bencherchali (Nextron Systems), Anish Bogati · Windows

highHackTool - XORDump ExecutionFlorian Roth (Nextron Systems) · Windows

highPotential LSASS Process Dump Via ProcdumpFlorian Roth (Nextron Systems) · Windows

highPotential SysInternals ProcDump EvasionFlorian Roth (Nextron Systems) · Windows

highProcess Execution From A Potentially Suspicious FolderFlorian Roth (Nextron Systems), Tim Shelton · Windows

highProcess Memory Dump Via Comsvcs.DLLFlorian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

highRenamed CreateDump Utility ExecutionFlorian Roth (Nextron Systems) · Windows

highRenamed Plink ExecutionNasreddine Bencherchali (Nextron Systems) · Windows

highRenamed ZOHO Dctask64 ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

highSdiagnhost Calling Suspicious Child ProcessNextron Systems, @Kostastsale · Windows

highSuspicious Calculator UsageFlorian Roth (Nextron Systems) · Windows

highSuspicious Child Process Of Wermgr.EXEFlorian Roth (Nextron Systems) · Windows

highSuspicious DumpMinitool ExecutionFlorian Roth (Nextron Systems) · Windows

highSuspicious MSDT Parent ProcessNextron Systems · Windows

highSuspicious Process ParentsFlorian Roth (Nextron Systems) · Windows

highSuspicious Windows Update Agent Empty CmdlineFlorian Roth (Nextron Systems) · Windows

highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows

highTaskmgr as LOCAL_SYSTEMFlorian Roth (Nextron Systems) · Windows

mediumCodePage Modification Via MODE.COM To Russian LanguageJoseliyo Sanchez, @Joseliyo_Jstnk · Windows

mediumDumpMinitool ExecutionNasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) · Windows

mediumExplorer Process Tree BreakFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber · Windows

mediumFindstr Launching .lnk FileTrent Liffick · Windows

mediumInteractive Bash Suspicious ChildrenFlorian Roth (Nextron Systems) · Linux

mediumPotential Command Line Path Traversal Evasion AttemptChristian Burkard (Nextron Systems) · Windows

mediumPotential Fake Instance Of Hxtsr.EXE ExecutedSreeman · Windows

mediumPotential Homoglyph Attack Using Lookalike CharactersMicah Babinski, @micahbabinski · Windows

mediumPotential ReflectDebugger Content Execution Via WerFault.EXEX__Junior (Nextron Systems) · Windows

mediumPotentially Suspicious Execution From Tmp FolderJoseliyo Sanchez, @Joseliyo_Jstnk · Linux

mediumProcdump ExecutionFlorian Roth (Nextron Systems) · Windows

mediumPUA - Potential PE Metadata Tamper Using RceditMicah Babinski · Windows

mediumSuspicious CodePage Switch Via CHCPFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · Windows

mediumSuspicious Process Start Locationsjuju4, Jonhnathan Ribeiro, oscd.community · Windows

lowCodePage Modification Via MODE.COMNasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk · Windows

lowNew Process Created Via Taskmgr.EXEFlorian Roth (Nextron Systems) · Windows