Cyber security

T1036.005 – Masquerading : Match Legitimate Name Or Location

In the cybersecurity landscape, attackers constantly devise methods to bypass security measures.

One sophisticated technique is T1036.005, or Masquerading: Match Legitimate Name or Location, where attackers mimic the names or locations of legitimate files to evade detection.

This article delves into how this tactic works, providing insights on detection and mitigation to help defenders enhance their security strategies.

ATT&CK Tags

Tactic: Defense Evasion

Technique: Masquerading: Match Legitimate Name or Location (T1036.005) Attackers often match or approximate the name or location of legitimate files to avoid detection rules that are based trust of certain operating system processes.

Technical Description Of The Attack

Permission Required To Execute The Technique

User

Detection Description

This rule detects mismatches in the parent-child relationship of core operating system processes to uncover different masquerading attempts.

Utilized Data Source

Event IDEvent NameLog ProviderATT&CK Data Source
DeviceProcessEventsMDEProcess monitoring

Hunt Details

KQL

FP Rate: Low

Source: MDE

Description: See above

Query:

let ProcessRelations=datatable(ImageFile:string,ExpectedParent:dynamic) [
    "smss.exe", dynamic(["smss.exe", "ntoskrnl.exe", ""]),
    "crmss.exe", dynamic(["smss.exe"]),
    "wininit.exe", dynamic(["smss.exe"]),
    "winlogon.exe", dynamic(["smss.exe"]),
    "services.exe", dynamic(["wininit.exe"]),
    "lsaiso.exe", dynamic(["wininit.exe"]),
    "lsass.exe", dynamic(["wininit.exe"]),
    "spoolsv.exe", dynamic(["services.exe"]),
    "dllhost.exe", dynamic(["svchost.exe"]),
    "lsm.exe", dynamic(["wininit.exe"]),
    "svchost.exe", dynamic(["services.exe", "msmpeng.exe"]),
    "runtimebroker.exe", dynamic(["svchost.exe"]),
    "taskhostw.exe", dynamic(["svchost.exe"]),
    "userinit.exe", dynamic(["winlogon.exe"])
    // Explorer can have a lot of parents in some environments
    //,"explorer.exe", dynamic(["userinit.exe"])
];
DeviceProcessEvents
| extend ImageFile = tostring(tolower(parse_path(tostring(FolderPath)).Filename))
| extend ParentFile = tostring(tolower(parse_path(tostring(InitiatingProcessFolderPath)).Filename))
| project Timestamp, ImageFile, ParentFile
| lookup kind=inner ProcessRelations on ImageFile
| where not(set_has_element(ExpectedParent,ParentFile))
| summarize count() by ImageFile, ParentFile

Considerations

  • The query is somewhat heavy on resources. Use it on a limited timefrime, for instance 24 hours – 7 days.
  • Some of these parent processes launch their childs and immediately terminate, which in some cases might cause the parent field to remain empty.
  • Some of the processes like dllhost can in some cases have other parent processes which can be legitimate, do validate them
  • Be prepared to find malware and backdoors – don’t run this query on Friday and ruin your weekend.

False Positives

  • For some reason, some software installers unpack and execute windows binaries using other names. This obviously triggers this rule.

Detection Blind Spots

  • There is an obvious blind spot for processes outside of the datatable.
Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

Pystinger : Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger is a Python-based tool that enables SOCKS4 proxying and port mapping through webshells. It…

1 week ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

1 week ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

1 week ago

How to Bash Append to File: A Simple Guide for Beginners

If you are working with Linux or writing bash scripts, one of the most common…

1 week ago

Mastering the Bash Case Statement with Simple Examples

What is a bash case statement? A bash case statement is a way to control…

1 week ago

How to Check if a File Exists in Bash – Simply Explained

Why Do We Check Files in Bash? When writing a Bash script, you often work…

1 week ago