Masquerading T1036

Events covered

30 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 261 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (128 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (5560 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (979 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 96 rules

• CodePage Modification Via MODE.COM
• CodePage Modification Via MODE.COM To Russian Language
• Computer account renamed without a trailing $ (CVE-2021-42278/42287)
• CreateDump Process Dump
• Creation Of Pod In System Namespace
• DumpMinitool Execution
• Exploit for CVE-2015-1641
• Explorer Process Tree Break
• File Download Via Bitsadmin
• File Download Via Bitsadmin To A Suspicious Target Folder
• File With Suspicious Extension Downloaded Via Bitsadmin
• Files With System DLL Name In Unsuspected Locations
• Files With System Process Name In Unsuspected Locations
• Findstr Launching .lnk File
• Flash Player Update from Suspicious Location
• Forfiles.EXE Child Process Masquerading
• Greenbug Espionage Group Indicators
• HackTool - XORDump Execution
• Interactive Bash Suspicious Children
• Lazarus System Binary Masquerading
• LOL-Binary Copied From System Directory
• Masquerading as Linux Crond Process
• MMC Executing Files with Reversed Extensions Using RTLO Abuse
• New or Renamed User Account with '$' Character
• New Process Created Via Taskmgr.EXE
• Operation Wocao Activity
• Operation Wocao Activity - Security
• Password Protected ZIP File Opened (Suspicious Filenames)
• Potential Binary Impersonating Sysinternals Tools
• Potential Command Line Path Traversal Evasion Attempt
• Potential Defense Evasion Via Binary Rename
• Potential Defense Evasion Via Rename Of Highly Relevant Binaries
• Potential Defense Evasion Via Right-to-Left Override
• Potential Fake Instance Of Hxtsr.EXE Executed
• Potential File Extension Spoofing Using Right-to-Left Override
• Potential Homoglyph Attack Using Lookalike Characters
• Potential Homoglyph Attack Using Lookalike Characters in Filename
• Potential LSASS Process Dump Via Procdump
• Potential MsiExec Masquerading
• Potential PendingFileRenameOperations Tampering
• Potential ReflectDebugger Content Execution Via WerFault.EXE
• Potential SysInternals ProcDump Evasion
• Potential WerFault ReflectDebugger Registry Value Abuse
• Potentially Suspicious Execution From Tmp Folder
• Procdump Execution
• Process Execution From A Potentially Suspicious Folder
• Process Memory Dump Via Comsvcs.DLL
• Ps.exe Renamed SysInternals Tool
• PUA - Potential PE Metadata Tamper Using Rcedit
• RedSun - Conhost.exe Spawned by TieringEngineService.exe
• RedSun - TieringEngineService.exe Detected as EICAR Test File
• RedSun - TieringEngineService.exe Staged in RS-Prefixed Temp Dir
• Remote Access Tool - Renamed MeshAgent Execution - MacOS
• Remote Access Tool - Renamed MeshAgent Execution - Windows
• Renamed BrowserCore.EXE Execution
• Renamed CreateDump Utility Execution
• Renamed Jusched.EXE Execution
• Renamed Msdt.EXE Execution
• Renamed Office Binary Execution
• Renamed Plink Execution
• Renamed Powershell Under Powershell Channel
• Renamed ProcDump Execution
• Renamed Schtasks Execution
• Renamed ZOHO Dctask64 Execution
• Scheduled Task Creation Masquerading as System Processes
• Sdiagnhost Calling Suspicious Child Process
• SearchIndexer suspicious process activity
• Small Sieve Malware File Indicator Creation
• Space After Filename - macOS
• Suspicious Calculator Usage
• Suspicious Child Process Of Wermgr.EXE
• Suspicious CodePage Switch Via CHCP
• Suspicious Computer Account Name Change CVE-2021-42287
• Suspicious Copy From or To System Directory
• Suspicious Double Extension Files
• Suspicious Download From Direct IP Via Bitsadmin
• Suspicious Download From File-Sharing Website Via Bitsadmin
• Suspicious DumpMinitool Execution
• Suspicious Files in Default GPO Folder
• Suspicious LNK Double Extension File Created
• Suspicious MSDT Parent Process
• Suspicious Parent Double Extension File Execution
• Suspicious Process Masquerading As SvcHost.EXE
• Suspicious Process Parents
• Suspicious Process Start Locations
• Suspicious Scheduled Task Creation via Masqueraded XML File
• Suspicious Start-Process PassThru
• Suspicious Windows Update Agent Empty Cmdline
• System File Execution Location Anomaly
• Taskmgr as LOCAL_SYSTEM
• Uncommon Svchost Command Line Parameter
• Uncommon Svchost Parent Process
• Unsigned .node File Loaded
• User account created by a computer account
• Windows Binaries Write Suspicious Extensions
• Windows Processes Suspicious Parent Directory

Elastic 78 rules

• Abnormal Process ID or Lock File Created
• Agent Spoofing - Multiple Hosts Using Same Agent
• Archive File with Unusual Extension
• Binary Executed from Shared Memory Directory
• Conhost Spawned By Suspicious Parent Process
• Directory Creation in /bin directory
• Executable File Creation with Multiple Extensions
• Executable File with Unusual Extension
• Executable Masquerading as Kernel Process
• Execution from Unusual Directory - Command Line
• Execution of an Unsigned Service
• Execution via Windows Command Debugging Utility
• Expired or Revoked Driver Loaded
• File with Right-to-Left Override Character (RTLO) Created/Executed
• Host Detected with Suspicious Windows Process(es)
• Image Loaded with Invalid Signature
• Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score
• Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score
• Masquerading Space After Filename
• Memory Dump File with Unusual Extension
• Microsoft Build Engine Using an Alternate Name
• Network Activity Detected via Kworker
• Parent Process Detected with Suspicious Windows Process(es)
• Potential Credential Access via Renamed COM+ Services DLL
• Potential CVE-2025-33053 Exploitation
• Potential Data Exfiltration via Rclone
• Potential DLL Side-Loading via Trusted Microsoft Programs
• Potential Kubectl Masquerading via Unexpected Process
• Potential Masquerading as Browser Process
• Potential Masquerading as Business App Installer
• Potential Masquerading as Communication Apps
• Potential Masquerading as Svchost
• Potential Masquerading as System32 DLL
• Potential Masquerading as System32 Executable
• Potential Masquerading as VLC DLL
• Potential Microsoft Office Sandbox Evasion
• Potential privilege escalation via CVE-2022-38028
• Potential Privilege Escalation via InstallerFileTakeOver
• Potential Privileged Escalation via SamAccountName Spoofing
• Potential Process Name Stomping with Prctl
• Potential Windows Error Manager Masquerading
• Process Backgrounded by Unusual Parent
• Process Execution from an Unusual Directory
• Process Started from Process ID (PID) File
• Processes with Trailing Spaces
• Program Files Directory Masquerading
• Renamed Automation Script Interpreter
• Renamed Utility Executed with Short Program Name
• Signed Proxy Execution via MS Work Folders
• Startup Folder Persistence via Unsigned Process
• Suspicious Communication App Child Process
• Suspicious DLL Loaded for Persistence or Privilege Escalation
• Suspicious Endpoint Security Parent Process
• Suspicious File Creation via Kworker
• Suspicious Kworker UID Elevation
• Suspicious Microsoft Antimalware Service Execution
• Suspicious Microsoft Diagnostics Wizard Execution
• Suspicious Outlook Child Process
• Suspicious Process Execution via Renamed PsExec Executable
• Suspicious Renaming of ESXI Files
• Suspicious WerFault Child Process
• Suspicious Zoom Child Process
• System Binary Moved or Copied
• System Path File Creation and Execution Detected via Defend for Containers
• Tampering with RUNNER_TRACKING_ID in GitHub Actions Runners
• UAC Bypass Attempt via Windows Directory Masquerading
• Unsigned BITS Service Client Process
• Unsigned DLL Loaded by Svchost
• Unsigned DLL Side-Loading from a Suspicious Folder
• Untrusted Driver Loaded
• Unusual Execution from Kernel Thread (kthreadd) Parent
• Unusual Network Activity from a Windows System Binary
• Unusual Parent-Child Relationship
• Unusual Process Execution on WBEM Path
• Unusual Process Extension
• Unusual Process Spawned by a Parent Process
• Unusual Process Spawned by a User
• User Detected with Suspicious Windows Process(es)

Splunk 63 rules

• 1 or 2 Character Executable (Windows Event Log)
• Attacker Tools On Endpoint
• Cisco NVM - Non-Network Binary Making Network Connection
• Detect RTLO In File Name
• Detect RTLO In Process
• DLL Concatenation (PowerShell)
• DLL Concatenation (Sysmon)
• DLL Concatenation (Windows Event Log)
• Email Attachments With Lots Of Spaces
• Executables Or Script Creation In Suspicious Path
• Executables Or Script Creation In Temp Path
• Execution of File with Multiple Extensions
• Linux Kworker Process In Writable Process Path
• Mock System Directory - Windows (Sysmon)
• Mock System Directory - Windows (Windows Event Log)
• Output to File (PowerShell)
• Output to File (Windows Event Log)
• Potential Executable Masquerading as Document - Windows (Sysmon)
• Potential Executable Masquerading as Document - Windows (Windows Event Log)
• Process Execution From Suspicious Folder (Sysmon)
• Process Execution From Suspicious Folder (Windows Event Log)
• Rename System Utilities (Windows Event Log)
• Renamed Process (Sysmon)
• Suspicious Child Process for lsass.exe (Sysmon)
• Suspicious Child Process for lsass.exe (Windows Event Log)
• Suspicious Copy on System32
• Suspicious File Created in Public Folder (Sysmon)
• Suspicious microsoft workflow compiler rename
• Suspicious msbuild path
• Suspicious MSBuild Rename
• Suspicious Parent Process for lsass.exe or services.exe (Sysmon)
• Suspicious Parent Process for lsass.exe or services.exe (Windows Event Log)
• Suspicious Parent Process for spoolsv.exe (Sysmon)
• Suspicious Parent Process for spoolsv.exe (Windows Event Log)
• Suspicious Process Executed From Container File
• Suspicious writes to windows Recycle Bin
• System Processes Run From Unexpected Locations
• Unexpected Network Connection from System Process (Sysmon)
• Unexpected Network Connection from System Process (Windows Event Log)
• Windows Bluetooth Service Installed From Uncommon Location
• Windows Debugger Tool Execution
• Windows DotNet Binary in Non Standard Path
• Windows Executable Masquerading as Benign File Types
• Windows InstallUtil in Non Standard Path
• Windows LOLBAS Executed As Renamed File
• Windows LOLBAS Executed Outside Expected Path
• Windows Masquerading Msdtc Process
• Windows MSC EvilTwin Directory Path Manipulation
• Windows NetSupport RMM DLL Loaded By Uncommon Process
• Windows Process Copied from System Folder (PowerShell)
• Windows Process Copied from System Folder (Sysmon)
• Windows Process Copied from System Folder (Windows Event Log)
• Windows Process Execution From ProgramData
• Windows Process Execution in Temp Dir
• Windows Process Outside of System Folder (Sysmon)
• Windows Process Outside of System Folder (Windows Event Log)
• Windows Renamed Powershell Execution
• Windows SoftEther VPN Masquerading as Legitimate Binary
• Windows Suspicious Process File Path
• Windows Suspicious QEMU Execution
• Windows Svchost.exe Parent Process Anomaly
• Windows TinyCC Shellcode Execution
• Windows Unusual SysWOW64 Process Run System32 Executable

Kusto 24 rules

• Certified Pre-Owned - backup of CA private key - rule 1
• Certified Pre-Owned - backup of CA private key - rule 2
• Certified Pre-Owned - TGTs requested with certificate authentication
• CyberArkEPM - Process started from different locations
• CyberArkEPM - Renamed Windows binary
• CyberArkEPM - Uncommon process Internet access
• CyberArkEPM - Uncommon Windows process started from System folder
• CyberArkEPM - Unexpected executable extension
• CyberArkEPM - Unexpected executable location
• Dataverse - New user agent type that was not used before
• Detect potential presence of a malicious file with a double extension (ASIM Web Session)
• GWorkspace - Unexpected OS update
• Masquerading Renamed executables of interest
• Match Legitimate Name or Location - 2
• Medium severity malicious activity detected
• Microsoft Entra ID Rare UserAgent App Sign-in
• Microsoft Entra ID UserAgent OS Missmatch
• Pathlock TDnR - Critical File Integrity Changes
• Potential re-named sdelete usage
• Potential re-named sdelete usage (ASIM Version)
• Rename System Utilities
• Unsigned Windows System Binary
• Votiro - File Blocked from Connector
• Votiro - File Blocked in Email