Cyber security

T1036.005 – Masquerading : Match Legitimate Name Or Location

In the cybersecurity landscape, attackers constantly devise methods to bypass security measures.

One sophisticated technique is T1036.005, or Masquerading: Match Legitimate Name or Location, where attackers mimic the names or locations of legitimate files to evade detection.

This article delves into how this tactic works, providing insights on detection and mitigation to help defenders enhance their security strategies.

ATT&CK Tags

Tactic: Defense Evasion

Technique: Masquerading: Match Legitimate Name or Location (T1036.005) Attackers often match or approximate the name or location of legitimate files to avoid detection rules that are based trust of certain operating system processes.

Technical Description Of The Attack

Permission Required To Execute The Technique

User

Detection Description

This rule detects mismatches in the parent-child relationship of core operating system processes to uncover different masquerading attempts.

Utilized Data Source

Event IDEvent NameLog ProviderATT&CK Data Source
DeviceProcessEventsMDEProcess monitoring

Hunt Details

KQL

FP Rate: Low

Source: MDE

Description: See above

Query:

let ProcessRelations=datatable(ImageFile:string,ExpectedParent:dynamic) [
    "smss.exe", dynamic(["smss.exe", "ntoskrnl.exe", ""]),
    "crmss.exe", dynamic(["smss.exe"]),
    "wininit.exe", dynamic(["smss.exe"]),
    "winlogon.exe", dynamic(["smss.exe"]),
    "services.exe", dynamic(["wininit.exe"]),
    "lsaiso.exe", dynamic(["wininit.exe"]),
    "lsass.exe", dynamic(["wininit.exe"]),
    "spoolsv.exe", dynamic(["services.exe"]),
    "dllhost.exe", dynamic(["svchost.exe"]),
    "lsm.exe", dynamic(["wininit.exe"]),
    "svchost.exe", dynamic(["services.exe", "msmpeng.exe"]),
    "runtimebroker.exe", dynamic(["svchost.exe"]),
    "taskhostw.exe", dynamic(["svchost.exe"]),
    "userinit.exe", dynamic(["winlogon.exe"])
    // Explorer can have a lot of parents in some environments
    //,"explorer.exe", dynamic(["userinit.exe"])
];
DeviceProcessEvents
| extend ImageFile = tostring(tolower(parse_path(tostring(FolderPath)).Filename))
| extend ParentFile = tostring(tolower(parse_path(tostring(InitiatingProcessFolderPath)).Filename))
| project Timestamp, ImageFile, ParentFile
| lookup kind=inner ProcessRelations on ImageFile
| where not(set_has_element(ExpectedParent,ParentFile))
| summarize count() by ImageFile, ParentFile

Considerations

  • The query is somewhat heavy on resources. Use it on a limited timefrime, for instance 24 hours – 7 days.
  • Some of these parent processes launch their childs and immediately terminate, which in some cases might cause the parent field to remain empty.
  • Some of the processes like dllhost can in some cases have other parent processes which can be legitimate, do validate them
  • Be prepared to find malware and backdoors – don’t run this query on Friday and ruin your weekend.

False Positives

  • For some reason, some software installers unpack and execute windows binaries using other names. This obviously triggers this rule.

Detection Blind Spots

  • There is an obvious blind spot for processes outside of the datatable.
Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

Cybersecurity – Tools And Their Function

Cybersecurity tools play a critical role in safeguarding digital assets, systems, and networks from malicious…

4 hours ago

MODeflattener – Miasm’s OLLVM Deflattener

MODeflattener is a specialized tool designed to reverse OLLVM's control flow flattening obfuscation through static…

4 hours ago

My Awesome List : Tools And Their Functions

"My Awesome List" is a curated collection of tools, libraries, and resources spanning various domains…

4 hours ago

Chrome Browser Exploitation, Part 3 : Analyzing And Exploiting CVE-2018-17463

CVE-2018-17463, a type confusion vulnerability in Chrome’s V8 JavaScript engine, allowed attackers to execute arbitrary…

4 hours ago

Chrome Browser Exploitation, Part 1 : Introduction To V8 And JavaScript Internals

The blog post "Chrome Browser Exploitation, Part 1: Introduction to V8 and JavaScript Internals" provides…

4 hours ago

Chrome Browser Exploitation, Part 3: Analyzing and Exploiting CVE-2018-17463

The exploitation of CVE-2018-17463, a type confusion vulnerability in Chrome’s V8 JavaScript engine, relies on…

7 hours ago