Masquerading: Match Legitimate Resource Name or Location T1036.005

Events covered

10 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 62 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (59 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (4077 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (432 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 21 rules

• Creation Of Pod In System Namespace
• Exploit for CVE-2015-1641
• Files With System DLL Name In Unsuspected Locations
• Files With System Process Name In Unsuspected Locations
• Flash Player Update from Suspicious Location
• Greenbug Espionage Group Indicators
• Lazarus System Binary Masquerading
• Potential Binary Impersonating Sysinternals Tools
• Potential MsiExec Masquerading
• RedSun - Conhost.exe Spawned by TieringEngineService.exe
• RedSun - TieringEngineService.exe Detected as EICAR Test File
• RedSun - TieringEngineService.exe Staged in RS-Prefixed Temp Dir
• Scheduled Task Creation Masquerading as System Processes
• Small Sieve Malware File Indicator Creation
• Suspicious Files in Default GPO Folder
• Suspicious Process Masquerading As SvcHost.EXE
• Suspicious Scheduled Task Creation via Masqueraded XML File
• Uncommon Svchost Command Line Parameter
• Uncommon Svchost Parent Process
• Unsigned .node File Loaded
• Windows Processes Suspicious Parent Directory

Elastic 30 rules

• Abnormal Process ID or Lock File Created
• Directory Creation in /bin directory
• Executable Masquerading as Kernel Process
• Execution from Unusual Directory - Command Line
• Execution via Windows Command Debugging Utility
• Potential CVE-2025-33053 Exploitation
• Potential Masquerading as Browser Process
• Potential Masquerading as Business App Installer
• Potential Masquerading as Communication Apps
• Potential Masquerading as Svchost
• Potential Masquerading as System32 DLL
• Potential Masquerading as System32 Executable
• Potential Masquerading as VLC DLL
• Potential Microsoft Office Sandbox Evasion
• Potential Privilege Escalation via InstallerFileTakeOver
• Potential Process Name Stomping with Prctl
• Potential Windows Error Manager Masquerading
• Process Execution from an Unusual Directory
• Process Started from Process ID (PID) File
• Program Files Directory Masquerading
• Signed Proxy Execution via MS Work Folders
• Suspicious Communication App Child Process
• Suspicious Endpoint Security Parent Process
• Suspicious File Creation via Kworker
• Suspicious Microsoft Antimalware Service Execution
• Suspicious Outlook Child Process
• System Path File Creation and Execution Detected via Defend for Containers
• UAC Bypass Attempt via Windows Directory Masquerading
• Unusual Network Activity from a Windows System Binary
• Unusual Process Execution on WBEM Path

Splunk 9 rules

• Attacker Tools On Endpoint
• Suspicious File Created in Public Folder (Sysmon)
• Windows LOLBAS Executed Outside Expected Path
• Windows MSC EvilTwin Directory Path Manipulation
• Windows Process Execution From ProgramData
• Windows Process Execution in Temp Dir
• Windows Process Outside of System Folder (Sysmon)
• Windows Process Outside of System Folder (Windows Event Log)
• Windows Suspicious Process File Path

Kusto 2 rules

• Match Legitimate Name or Location - 2
• Unsigned Windows System Binary