T1036.005 — Match Legitimate Resource Name or Location
Tactic: Stealth · Platforms: Containers, ESXi, Linux, macOS, Windows
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32)…
Sub-technique of Masquerading (T1036).
Sigma detection rules (5)
T1036.005 Masquerading: Match Legitimate Resource Name or Location
title: "T1036.005 Masquerading: Match Legitimate Resource Name or Location"
id: af455bd6-1341-45ea-aa73-b9d2a28597f9
description: 'Detection Strategy for Masquerading via Legitimate Resource Name or Location. (Retargeted from the original process_creation label to file_event — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: trusted_directory_list, process_baseline_age.'
references:
- https://attack.mitre.org/techniques/T1036/005
author: Shahrukh Khan
date: 2026-05-25
license: MIT
tags:
- attack.stealth
- attack.t1036.005
logsource:
category: file_event
product: windows
service: sysmon
detection:
selection:
TargetFilename|endswith:
- '\svchost.exe'
- '\lsass.exe'
- '\csrss.exe'
filter_correct_path:
TargetFilename|startswith:
- 'C:\Windows\System32\'
- 'C:\Windows\SysWOW64\'
condition: selection and not filter_correct_path
falsepositives:
- Rare — legitimate software should never write files matching these exact critical system-process names outside their expected system directories.
level: high
T1036.005 Masquerading: Match Legitimate Resource Name or Location
title: "T1036.005 Masquerading: Match Legitimate Resource Name or Location"
id: e9c33141-701d-4926-9bdf-5ed70ef44fbf
description: 'Detection Strategy for Masquerading via Legitimate Resource Name or Location. The original rule matched execve of genuine binaries at their own real canonical paths, making it tautological (it fired on all normal execution of systemd/sshd/bash). Fixed to require a trusted process name (comm) that does NOT correspond to that name''s known canonical exe path, which is the actual masquerading signature (e.g. malware naming its process "kworker" to blend in with kernel worker threads while its real executable lives outside kernel-thread territory). Tune using: monitored_paths, hash_validation_window.'
references:
- https://attack.mitre.org/techniques/T1036/005
author: Shahrukh Khan
date: 2026-04-19
license: MIT
tags:
- attack.stealth
- attack.t1036.005
logsource:
category: process_creation
product: linux
detection:
selection_trusted_name:
type: SYSCALL
syscall: execve
comm:
- 'systemd'
- 'sshd'
- 'bash'
- 'kworker'
- 'init'
exe|exists: true
filter_canonical_path:
exe:
- '/usr/bin/systemd'
- '/usr/lib/systemd/systemd'
- '/usr/sbin/sshd'
- '/usr/bin/bash'
- '/bin/bash'
condition: selection_trusted_name and not filter_canonical_path
falsepositives:
- Distributions that install these binaries under additional legitimate canonical paths (e.g. a distro-specific symlink location) must have those paths added to filter_canonical_path or this will over-fire; hash-based validation that the exe at a path is genuinely the legitimate binary is still not possible from auditd alone.
level: high
T1036.005 Masquerading: Match Legitimate Resource Name or Location
title: "T1036.005 Masquerading: Match Legitimate Resource Name or Location"
id: b8c95db7-224b-4181-9aef-14d28cb129dd
description: 'Detection Strategy for Masquerading via Legitimate Resource Name or Location. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: expected_bundle_names, signed_by_apple_check.'
references:
- https://attack.mitre.org/techniques/T1036/005
author: Shahrukh Khan
date: 2026-05-13
license: MIT
tags:
- attack.stealth
- attack.t1036.005
logsource:
category: process_creation
product: macos
detection:
selection:
Image|re: '.*/(launchd|syslogd|mdworker|kernel_task)