Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during Create Account, although accounts may also be renamed at a later date. This may also coincide with Account Access Removal if the actor first deletes an…
Sub-technique of Masquerading (T1036).
Sigma detection rules (4)
T1036.010 Masquerading: Masquerade Account Name
title: "T1036.010 Masquerading: Masquerade Account Name"
id: ce7726b6-2944-4e13-a87d-b9d1c881aeef
description: 'Detection Strategy for Masquerading via Account Name Similarity. (Data Component: User Account Creation; baseline tier: windows-eventid.) Tune using: SimilarityThreshold, MonitoredAccountList, TimeWindow.'
references:
- https://attack.mitre.org/techniques/T1036/010
author: Shahrukh Khan
date: 2026-04-16
license: MIT
tags:
- attack.stealth
- attack.t1036.010
logsource:
product: windows
service: security
detection:
selection_base:
EventID: '4720'
selection_admin_like:
TargetUserName|contains:
- 'admin'
- 'Admin'
- 'ADMIN'
filter_exact_builtin:
TargetUserName: 'Administrator'
filter_system_account:
User|contains:
- 'SYSTEM'
- 'LOCAL SERVICE'
- 'NETWORK SERVICE'
condition: selection_base and selection_admin_like and not filter_exact_builtin and not filter_system_account
falsepositives:
- System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.
- Legitimate secondary admin accounts created by IT with intentional 'admin' naming conventions (e.g. 'jsmith-admin').
level: medium
T1036.010 Masquerading: Masquerade Account Name
title: "T1036.010 Masquerading: Masquerade Account Name"
id: 1b4bd573-8827-432e-afbf-243d7529b48e
description: 'Detection Strategy for Masquerading via Account Name Similarity. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) No longer assumes the target username sits at fixed argv position a1 (real useradd/adduser invocations commonly place options like -m/-s/-G before the trailing username); the regex is now matched across a1 through a6 to catch the username regardless of how many preceding flags/options were passed. Tune using: AllowedSystemAccounts, LevenshteinThreshold, ScriptInitiatorDetection.'
references:
- https://attack.mitre.org/techniques/T1036/010
author: Shahrukh Khan
date: 2026-04-21
license: MIT
tags:
- attack.stealth
- attack.t1036.010
logsource:
category: process_creation
product: linux
detection:
selection:
type: EXECVE
a0|endswith:
- '/useradd'
- '/adduser'
selection_name:
- a1|re: '^(system|daemon|sync|www|root)[0-9]?