Masquerading T1036

Events covered

33 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 313 rules share fields, values, and exclusions.

Fields filtered most (147 distinct)

These fields appear most often in rule filters.

Top indicator values (6333 distinct)

These values appear most often in rule predicates.

Exclusions (1698 distinct)

These values appear most often in top-level exclusions.

Rules under this technique

These vendors publish rules tagged with this technique.

Sigma 97 rules

• CodePage Modification Via MODE.COM
• CodePage Modification Via MODE.COM To Russian Language
• Computer account renamed without a trailing $ (CVE-2021-42278/42287)
• CreateDump Process Dump
• Creation Of Pod In System Namespace
• DumpMinitool Execution
• Exploit for CVE-2015-1641
• Explorer Process Tree Break
• File Download Via Bitsadmin
• File Download Via Bitsadmin To A Suspicious Target Folder
• File With Suspicious Extension Downloaded Via Bitsadmin
• Files With System DLL Name In Unsuspected Locations
• Files With System Process Name In Unsuspected Locations
• Findstr Launching .lnk File
• Flash Player Update from Suspicious Location
• Forfiles.EXE Child Process Masquerading
• Greenbug Espionage Group Indicators
• HackTool - XORDump Execution
• Interactive Bash Suspicious Children
• Lazarus System Binary Masquerading
• LOL-Binary Copied From System Directory
• Masquerading as Linux Crond Process
• MMC Executing Files with Reversed Extensions Using RTLO Abuse
• New or Renamed User Account with '$' Character
• New Process Created Via Taskmgr.EXE
• Non-DLL Extension File Renamed With DLL Extension
• Operation Wocao Activity
• Operation Wocao Activity - Security
• Password Protected ZIP File Opened (Suspicious Filenames)
• Potential Binary Impersonating Sysinternals Tools
• Potential Command Line Path Traversal Evasion Attempt
• Potential Defense Evasion Via Binary Rename
• Potential Defense Evasion Via Rename Of Highly Relevant Binaries
• Potential Defense Evasion Via Right-to-Left Override
• Potential Fake Instance Of Hxtsr.EXE Executed
• Potential File Extension Spoofing Using Right-to-Left Override
• Potential Homoglyph Attack Using Lookalike Characters
• Potential Homoglyph Attack Using Lookalike Characters in Filename
• Potential LSASS Process Dump Via Procdump
• Potential MsiExec Masquerading
• Potential PendingFileRenameOperations Tampering
• Potential ReflectDebugger Content Execution Via WerFault.EXE
• Potential SysInternals ProcDump Evasion
• Potential WerFault ReflectDebugger Registry Value Abuse
• Potentially Suspicious Execution From Tmp Folder
• Procdump Execution
• Process Execution From A Potentially Suspicious Folder
• Process Memory Dump Via Comsvcs.DLL
• Ps.exe Renamed SysInternals Tool
• PUA - Potential PE Metadata Tamper Using Rcedit
• RedSun - Conhost.exe Spawned by TieringEngineService.exe
• RedSun - TieringEngineService.exe Detected as EICAR Test File
• RedSun - TieringEngineService.exe Staged in RS-Prefixed Temp Dir
• Remote Access Tool - Renamed MeshAgent Execution - MacOS
• Remote Access Tool - Renamed MeshAgent Execution - Windows
• Renamed BrowserCore.EXE Execution
• Renamed CreateDump Utility Execution
• Renamed Jusched.EXE Execution
• Renamed Msdt.EXE Execution
• Renamed Office Binary Execution
• Renamed Plink Execution
• Renamed Powershell Under Powershell Channel
• Renamed ProcDump Execution
• Renamed Schtasks Execution
• Renamed ZOHO Dctask64 Execution
• Scheduled Task Creation Masquerading as System Processes
• Sdiagnhost Calling Suspicious Child Process
• SearchIndexer suspicious process activity
• Small Sieve Malware File Indicator Creation
• Space After Filename - macOS
• Suspicious Calculator Usage
• Suspicious Child Process Of Wermgr.EXE
• Suspicious CodePage Switch Via CHCP
• Suspicious Computer Account Name Change CVE-2021-42287
• Suspicious Copy From or To System Directory
• Suspicious Double Extension Files
• Suspicious Download From Direct IP Via Bitsadmin
• Suspicious Download From File-Sharing Website Via Bitsadmin
• Suspicious DumpMinitool Execution
• Suspicious Files in Default GPO Folder
• Suspicious LNK Double Extension File Created
• Suspicious MSDT Parent Process
• Suspicious Parent Double Extension File Execution
• Suspicious Process Masquerading As SvcHost.EXE
• Suspicious Process Parents
• Suspicious Process Start Locations
• Suspicious Scheduled Task Creation via Masqueraded XML File
• Suspicious Start-Process PassThru
• Suspicious Windows Update Agent Empty Cmdline
• System File Execution Location Anomaly
• Taskmgr as LOCAL_SYSTEM
• Uncommon Svchost Command Line Parameter
• Uncommon Svchost Parent Process
• Unsigned .node File Loaded
• User account created by a computer account
• Windows Binaries Write Suspicious Extensions
• Windows Processes Suspicious Parent Directory

Elastic 127 rules

• Abnormal Process ID or Lock File Created
• Agent Spoofing - Multiple Hosts Using Same Agent
• API Call from a Process with a Spoofed Parent
• Archive File with Unusual Extension
• Binary Executed from Shared Memory Directory
• Binary Masquerading via Untrusted Path
• Conhost Spawned By Suspicious Parent Process
• Decoy file Open via Preview App
• Direct Process Execution via Background Utility
• Directory Creation in /bin directory
• Evasion via File Name Masquerading
• Executable File Creation with Multiple Extensions
• Executable File with Unusual Extension
• Executable Masquerading as Kernel Process
• Execution from Suspicious Directory
• Execution from Unusual Directory - Command Line
• Execution of an Unsigned Service
• Execution of Non-Executable File via Shell
• Execution via Suspicious JavaScript Updates
• Execution via Windows Command Debugging Utility
• Expired or Revoked Driver Loaded
• File with Right-to-Left Override Character (RTLO) Created/Executed
• Host Detected with Suspicious Windows Process(es)
• Image Load via Synthetic Stack Spoofing
• Image Loaded with Invalid Signature
• Library Load from a Truncated Stack
• Library Loaded From a Potentially Altered Call Stack
• Library Loaded from a Spoofed Call Stack
• Mach-O File with Unusual Extension
• Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score
• Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score
• Malicious Ledger Live Execution
• Masquerading Space After Filename
• Memory Dump File with Unusual Extension
• Microsoft Build Engine Using an Alternate Name
• Network Activity Detected via Kworker
• Network Connection via Process with Unusual Arguments
• Parent Process Detected with Suspicious Windows Process(es)
• Persistence via a Masqueraded Plist Filename
• Potential Binary Masquerading via Invalid Code Signature
• Potential Credential Access via Renamed COM+ Services DLL
• Potential CVE-2025-33053 Exploitation
• Potential Data Exfiltration via Rclone
• Potential DLL Side-Loading via Trusted Microsoft Programs
• Potential Evasion via Invalid Code Signature
• Potential Kubectl Masquerading via Unexpected Process
• Potential Masquerading as Browser Process
• Potential Masquerading as Business App Installer
• Potential Masquerading as Communication Apps
• Potential Masquerading as Svchost
• Potential Masquerading as SVCHOST
• Potential Masquerading as System Binary
• Potential Masquerading as System32 DLL
• Potential Masquerading as System32 Executable
• Potential Masquerading as VLC DLL
• Potential Masquerading as Windows Error Manager
• Potential Masquerading via /proc/self/exe
• Potential Microsoft Office Sandbox Evasion
• Potential privilege escalation via CVE-2022-38028
• Potential Privilege Escalation via InstallerFileTakeOver
• Potential Privilege Escalation via RoguePlanet Windows Defender Exploit
• Potential Privileged Escalation via SamAccountName Spoofing
• Potential Process Name Stomping with Prctl
• Potential Windows Error Manager Masquerading
• Process Backgrounded by Unusual Parent
• Process Execution from an Unusual Directory
• Process Execution from Boot Directory
• Process Execution with Unusual File Extension
• Process Started from Process ID (PID) File
• Processes with Trailing Spaces
• Program Files Directory Masquerading
• Registry Modification from a Potentially Altered Call Stack
• Renamed AutoIt Scripts Interpreter
• Renamed Automation Script Interpreter
• Renamed Third Party Administrator Tools
• Renamed Utility Executed with Short Program Name
• Renamed Windows Automaton Script Interpreter
• Shell Command Execution via Kworker
• Shell Execution of Non-Executable File
• Signed Proxy Execution via MS Work Folders
• Stack Spoofing via ROP Gadget for DLL Load
• Stack Spoofing via ROP Gadget for Memory API
• Startup Folder Persistence via Unsigned Process
• Suspicious Binary Execution via Path Alias
• Suspicious Communication App Child Process
• Suspicious DLL Loaded for Persistence or Privilege Escalation
• Suspicious Endpoint Security Parent Process
• Suspicious Executable Copied from Volume Mount
• Suspicious File Creation via Kworker
• Suspicious Kworker UID Elevation
• Suspicious Microsoft Antimalware Service Execution
• Suspicious Microsoft Diagnostics Wizard Execution
• Suspicious Network Library Load
• Suspicious Network Module LoadLibrary
• Suspicious Null Terminated Call Stack
• Suspicious Outlook Child Process
• Suspicious Parent-Child Relationship
• Suspicious Process Execution via Renamed PsExec Executable
• Suspicious Process with a Spoofed Parent
• Suspicious Renaming of ESXI Files
• Suspicious Scheduled Task Creation via Masqueraded XML File
• Suspicious WerFault Child Process
• Suspicious Windows Explorer Execution
• Suspicious Windows LUA Script Execution
• Suspicious Zoom Child Process
• System Binary Copied or Moved
• System Binary Moved or Copied
• System Path File Creation and Execution Detected via Defend for Containers
• Tampering with RUNNER_TRACKING_ID in GitHub Actions Runners
• UAC Bypass Attempt via Windows Directory Masquerading
• Unsigned BITS Service Client Process
• Unsigned DLL from Suspicious Directory
• Unsigned DLL Loaded by Svchost
• Unsigned DLL Side-Loading from a Suspicious Folder
• Untrusted Driver Loaded
• Unusual Execution from Kernel Thread (kthreadd) Parent
• Unusual File Written or Modified in Startup Folder
• Unusual Network Activity from a Windows System Binary
• Unusual Parent-Child Relationship
• Unusual Process Execution on WBEM Path
• Unusual Process Extension
• Unusual Process Spawned by a Parent Process
• Unusual Process Spawned by a User
• User Detected with Suspicious Windows Process(es)
• VirtualProtect Call via NtTestAlert
• VirtualProtect from Unusual NTDLL Offset
• Windows Error Manager/Reporting Masquerading

Splunk 65 rules

• 1 or 2 Character Executable (Windows Event Log)
• Attacker Tools On Endpoint
• Cisco NVM - Non-Network Binary Making Network Connection
• Detect RTLO In File Name
• Detect RTLO In Process
• DLL Concatenation (PowerShell)
• DLL Concatenation (Sysmon)
• DLL Concatenation (Windows Event Log)
• Email Attachments With Lots Of Spaces
• Executables Or Script Creation In Suspicious Path
• Executables Or Script Creation In Temp Path
• Execution of File with Multiple Extensions
• Linux Kworker Process In Writable Process Path
• Linux Possible System Binary Backdoor
• Linux Suspicious Staging of Alternate System Files
• Mock System Directory - Windows (Sysmon)
• Mock System Directory - Windows (Windows Event Log)
• Output to File (PowerShell)
• Output to File (Windows Event Log)
• Potential Executable Masquerading as Document - Windows (Sysmon)
• Potential Executable Masquerading as Document - Windows (Windows Event Log)
• Process Execution From Suspicious Folder (Sysmon)
• Process Execution From Suspicious Folder (Windows Event Log)
• Rename System Utilities (Windows Event Log)
• Renamed Process (Sysmon)
• Suspicious Child Process for lsass.exe (Sysmon)
• Suspicious Child Process for lsass.exe (Windows Event Log)
• Suspicious Copy on System32
• Suspicious File Created in Public Folder (Sysmon)
• Suspicious microsoft workflow compiler rename
• Suspicious msbuild path
• Suspicious MSBuild Rename
• Suspicious Parent Process for lsass.exe or services.exe (Sysmon)
• Suspicious Parent Process for lsass.exe or services.exe (Windows Event Log)
• Suspicious Parent Process for spoolsv.exe (Sysmon)
• Suspicious Parent Process for spoolsv.exe (Windows Event Log)
• Suspicious Process Executed From Container File
• Suspicious writes to windows Recycle Bin
• System Processes Run From Unexpected Locations
• Unexpected Network Connection from System Process (Sysmon)
• Unexpected Network Connection from System Process (Windows Event Log)
• Windows Bluetooth Service Installed From Uncommon Location
• Windows Debugger Tool Execution
• Windows DotNet Binary in Non Standard Path
• Windows Executable Masquerading as Benign File Types
• Windows InstallUtil in Non Standard Path
• Windows LOLBAS Executed As Renamed File
• Windows LOLBAS Executed Outside Expected Path
• Windows Masquerading Msdtc Process
• Windows MSC EvilTwin Directory Path Manipulation
• Windows NetSupport RMM DLL Loaded By Uncommon Process
• Windows Process Copied from System Folder (PowerShell)
• Windows Process Copied from System Folder (Sysmon)
• Windows Process Copied from System Folder (Windows Event Log)
• Windows Process Execution From ProgramData
• Windows Process Execution in Temp Dir
• Windows Process Outside of System Folder (Sysmon)
• Windows Process Outside of System Folder (Windows Event Log)
• Windows Renamed Powershell Execution
• Windows SoftEther VPN Masquerading as Legitimate Binary
• Windows Suspicious Process File Path
• Windows Suspicious QEMU Execution
• Windows Svchost.exe Parent Process Anomaly
• Windows TinyCC Shellcode Execution
• Windows Unusual SysWOW64 Process Run System32 Executable

Kusto 24 rules

• Certified Pre-Owned - backup of CA private key - rule 1
• Certified Pre-Owned - backup of CA private key - rule 2
• Certified Pre-Owned - TGTs requested with certificate authentication
• CyberArkEPM - Process started from different locations
• CyberArkEPM - Renamed Windows binary
• CyberArkEPM - Uncommon process Internet access
• CyberArkEPM - Uncommon Windows process started from System folder
• CyberArkEPM - Unexpected executable extension
• CyberArkEPM - Unexpected executable location
• Dataverse - New user agent type that was not used before
• Detect potential presence of a malicious file with a double extension (ASIM Web Session)
• GWorkspace - Unexpected OS update
• Masquerading Renamed executables of interest
• Match Legitimate Name or Location - 2
• Medium severity malicious activity detected
• Microsoft Entra ID Rare UserAgent App Sign-in
• Microsoft Entra ID UserAgent OS Missmatch
• Pathlock TDnR - Critical File Integrity Changes
• Potential re-named sdelete usage
• Potential re-named sdelete usage (ASIM Version)
• Rename System Utilities
• Unsigned Windows System Binary
• Votiro - File Blocked from Connector
• Votiro - File Blocked in Email