Description
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.
This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.(Citation: Aquasec Kubernetes Backdoor 2023)
Platforms
Mitigations (3)
Execution PreventionM1038
Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.
Code SigningM1045
Require signed binaries and images.
Restrict File and Directory PermissionsM1022
Use file system access controls to protect folders such as C:\Windows\System32.
Threat Groups (63)
| ID | Group | Context |
|---|---|---|
| G0119 | Indrik Spider | [Indrik Spider](https://attack.mitre.org/groups/G0119) used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.(Citati... |
| G1008 | SideCopy | [SideCopy](https://attack.mitre.org/groups/G1008) has used a legitimate DLL file name, `Duser.dll` to disguise a malicious remote access tool.(Citatio... |
| G1020 | Mustard Tempest | [Mustard Tempest](https://attack.mitre.org/groups/G1020) has used the filename `AutoUpdater.js` to mimic legitimate update files and has also used the... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has renamed malware to legitimate names such as <code>ESTCommon.dll</code> or <code>patch.dll</code>.... |
| G0018 | admin@338 | [admin@338](https://attack.mitre.org/groups/G0018) actors used the following command to rename one of their tools to a benign file name: <code>ren "%t... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has used legitimate looking filenames for compressed copies of the ntds.dit database and used na... |
| G0040 | Patchwork | [Patchwork](https://attack.mitre.org/groups/G0040) installed its payload in the startup programs folder as "Baidu Software Update." The group also add... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) attempted to masquerade their files as popular anti-virus software.(Citation: FireEye APT41 Aug 2019)(C... |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) has been seen changing malicious files to appear legitimate.(Citation: District Court of NY APT10 In... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update. [APT32](https://attack.m... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has disguised malicious executables and used filenames and Registry key names associated with Wind... |
| G0019 | Naikon | [Naikon](https://attack.mitre.org/groups/G0019) has disguised malicious programs as Google Chrome, Adobe, and VMware executables.(Citation: Bitdefende... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) has used legitimate process names to hide malware including <code>svchosst</code>.(Citation: ... |
| G1046 | Storm-1811 | [Storm-1811](https://attack.mitre.org/groups/G1046) has disguised [Cobalt Strike](https://attack.mitre.org/software/S0154) installers as a malicious D... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has replaced .dockerd and .dockerenv with their own scripts and cryptocurrency mining software.(Citat... |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) has attempted to run Darkside ransomware with the filename sleep.exe.(Citation: CrowdStrike Carbon Spide... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) has avoided detection by naming a malicious binary explorer.exe.(Citation: ESET Telebots Dec 20... |
| G0095 | Machete | [Machete](https://attack.mitre.org/groups/G0095)'s [Machete](https://attack.mitre.org/software/S0409) MSI installer has masqueraded as a legitimate Ad... |
| G0121 | Sidewinder | [Sidewinder](https://attack.mitre.org/groups/G0121) has named malicious files <code>rekeywiz.exe</code> to match the name of a legitimate Windows exec... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has used names like `adobeupdate.dat` and `PotPlayerDB.dat` to disguise [PlugX](https://attack.... |
Associated Software (143)
| ID | Name | Type | Context |
|---|---|---|---|
| S0605 | EKANS | Malware | [EKANS](https://attack.mitre.org/software/S0605) has been disguised as <code>update.exe</code> to appear as a valid executable.(Citation: Dragos EKANS... |
| S0520 | BLINDINGCAN | Malware | [BLINDINGCAN](https://attack.mitre.org/software/S0520) has attempted to hide its payload by using legitimate file names such as "iconcache.db".(Citati... |
| S1100 | Ninja | Malware | [Ninja](https://attack.mitre.org/software/S1100) has used legitimate looking filenames for its loader including update.dll and x64.dll.(Citation: Kasp... |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) has named component DLLs "RapportGP.dll" to match those used by the security company Trusteer.(Ci... |
| S9015 | BRICKSTORM | Malware | [BRICKSTORM](https://attack.mitre.org/software/S9015) has appeared to resemble legitimate processes to include the vCenter process `vami-http`.(Citati... |
| S0353 | NOKKI | Malware | [NOKKI](https://attack.mitre.org/software/S0353) is written to %LOCALAPPDATA%\MicroSoft Updatea\svServiceUpdate.exe prior being executed in a new proc... |
| S1078 | RotaJakiro | Malware | [RotaJakiro](https://attack.mitre.org/software/S1078) has used the filename `systemd-daemon` in an attempt to appear legitimate.(Citation: netlab360 r... |
| S1041 | Chinoxy | Malware | [Chinoxy](https://attack.mitre.org/software/S1041) has used the name `eoffice.exe` in attempt to appear as a legitimate file.(Citation: Bitdefender Fu... |
| S0083 | Misdat | Malware | [Misdat](https://attack.mitre.org/software/S0083) saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distrib... |
| S0386 | Ursnif | Malware | [Ursnif](https://attack.mitre.org/software/S0386) has used strings from legitimate system files and existing folders for its file, folder, and Registr... |
| S0665 | ThreatNeedle | Malware | [ThreatNeedle](https://attack.mitre.org/software/S0665) chooses its payload creation path from a randomly selected service name from netsvc.(Citation:... |
| S0086 | ZLib | Malware | [ZLib](https://attack.mitre.org/software/S0086) mimics the resource version information of legitimate Realtek Semiconductor, Nvidia, or Synaptics modu... |
| S9034 | Tsundere Botnet | Malware | [Tsundere Botnet](https://attack.mitre.org/software/S9034) has disguised its MSI installer as a fake installer for popular games and software.(Citatio... |
| S0171 | Felismus | Malware | [Felismus](https://attack.mitre.org/software/S0171) has masqueraded as legitimate Adobe Content Management System files.(Citation: ATT Felismus) |
| S0491 | StrongPity | Malware | [StrongPity](https://attack.mitre.org/software/S0491) has been bundled with legitimate software installation files for disguise.(Citation: Talos Prome... |
| S0630 | Nebulae | Malware | [Nebulae](https://attack.mitre.org/software/S0630) uses functions named <code>StartUserModeBrowserInjection</code> and <code>StopUserModeBrowserInject... |
| S1239 | TONESHELL | Malware | [TONESHELL](https://attack.mitre.org/software/S1239) has renamed malicious files to mimic legitimate file names and file extensions.(Citation: 2022 No... |
| S0629 | RainyDay | Malware | [RainyDay](https://attack.mitre.org/software/S0629) has used names to mimic legitimate software including "vmtoolsd.exe" to spoof Vmtools.(Citation: B... |
| S0622 | AppleSeed | Malware | [AppleSeed](https://attack.mitre.org/software/S0622) has the ability to rename its payload to ESTCommon.dll to masquerade as a DLL belonging to ESTsec... |
| S0198 | NETWIRE | Malware | [NETWIRE](https://attack.mitre.org/software/S0198) has masqueraded as legitimate software including TeamViewer and macOS Finder.(Citation: Red Canary ... |
References
Frequently Asked Questions
What is T1036.005 (Match Legitimate Resource Name or Location)?
T1036.005 is a MITRE ATT&CK technique named 'Match Legitimate Resource Name or Location'. It belongs to the Stealth tactic(s). Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation...
How can T1036.005 be detected?
Detection of T1036.005 (Match Legitimate Resource Name or Location) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1036.005?
There are 3 documented mitigations for T1036.005. Key mitigations include: Execution Prevention, Code Signing, Restrict File and Directory Permissions.
Which threat groups use T1036.005?
Known threat groups using T1036.005 include: Indrik Spider, SideCopy, Mustard Tempest, Kimsuky, admin@338, Volt Typhoon, Patchwork, APT41.