Cyber security

T1036.005 – Masquerading : Match Legitimate Name Or Location

In the cybersecurity landscape, attackers constantly devise methods to bypass security measures.

One sophisticated technique is T1036.005, or Masquerading: Match Legitimate Name or Location, where attackers mimic the names or locations of legitimate files to evade detection.

This article delves into how this tactic works, providing insights on detection and mitigation to help defenders enhance their security strategies.

ATT&CK Tags

Tactic: Defense Evasion

Technique: Masquerading: Match Legitimate Name or Location (T1036.005) Attackers often match or approximate the name or location of legitimate files to avoid detection rules that are based trust of certain operating system processes.

Technical Description Of The Attack

Permission Required To Execute The Technique

User

Detection Description

This rule detects mismatches in the parent-child relationship of core operating system processes to uncover different masquerading attempts.

Utilized Data Source

Event IDEvent NameLog ProviderATT&CK Data Source
DeviceProcessEventsMDEProcess monitoring

Hunt Details

KQL

FP Rate: Low

Source: MDE

Description: See above

Query:

let ProcessRelations=datatable(ImageFile:string,ExpectedParent:dynamic) [
    "smss.exe", dynamic(["smss.exe", "ntoskrnl.exe", ""]),
    "crmss.exe", dynamic(["smss.exe"]),
    "wininit.exe", dynamic(["smss.exe"]),
    "winlogon.exe", dynamic(["smss.exe"]),
    "services.exe", dynamic(["wininit.exe"]),
    "lsaiso.exe", dynamic(["wininit.exe"]),
    "lsass.exe", dynamic(["wininit.exe"]),
    "spoolsv.exe", dynamic(["services.exe"]),
    "dllhost.exe", dynamic(["svchost.exe"]),
    "lsm.exe", dynamic(["wininit.exe"]),
    "svchost.exe", dynamic(["services.exe", "msmpeng.exe"]),
    "runtimebroker.exe", dynamic(["svchost.exe"]),
    "taskhostw.exe", dynamic(["svchost.exe"]),
    "userinit.exe", dynamic(["winlogon.exe"])
    // Explorer can have a lot of parents in some environments
    //,"explorer.exe", dynamic(["userinit.exe"])
];
DeviceProcessEvents
| extend ImageFile = tostring(tolower(parse_path(tostring(FolderPath)).Filename))
| extend ParentFile = tostring(tolower(parse_path(tostring(InitiatingProcessFolderPath)).Filename))
| project Timestamp, ImageFile, ParentFile
| lookup kind=inner ProcessRelations on ImageFile
| where not(set_has_element(ExpectedParent,ParentFile))
| summarize count() by ImageFile, ParentFile

Considerations

  • The query is somewhat heavy on resources. Use it on a limited timefrime, for instance 24 hours – 7 days.
  • Some of these parent processes launch their childs and immediately terminate, which in some cases might cause the parent field to remain empty.
  • Some of the processes like dllhost can in some cases have other parent processes which can be legitimate, do validate them
  • Be prepared to find malware and backdoors – don’t run this query on Friday and ruin your weekend.

False Positives

  • For some reason, some software installers unpack and execute windows binaries using other names. This obviously triggers this rule.

Detection Blind Spots

  • There is an obvious blind spot for processes outside of the datatable.
Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

cp Command: Copy Files and Directories in Linux

The cp command, short for "copy," is the main Linux utility for duplicating files and directories. Whether…

1 week ago

Image OSINT

Introduction In digital investigations, images often hold more information than meets the eye. With the…

1 week ago

cat Command: Read and Combine File Contents in Linux

The cat command short for concatenate, It is a fast and versatile tool for viewing and merging…

1 week ago

Port In Networking

What is a Port? A port in networking acts like a gateway that directs data…

1 week ago

ls Command: List Directory Contents in Linux

The ls command is fundamental for anyone working with Linux. It’s used to display the files and…

1 week ago

pwd Command: Find Your Location in Linux

The pwd (Print Working Directory) command is essential for navigating the Linux filesystem. It instantly shows your…

1 week ago