T1036.005 Match Legitimate Resource Name or Location — Detection Rules

Source-backed rule directory

• Creation Of Pod In System Namespace · test · medium · {"category":"application","product":"kubernetes","service":"audit"}
• Flash Player Update from Suspicious Location · test · high · {"category":"proxy"}
• Files With System DLL Name In Unsuspected Locations · test · medium · {"category":"file_event","product":"windows"}
• Files With System Process Name In Unsuspected Locations · test · medium · {"category":"file_event","product":"windows"}
• Suspicious Files in Default GPO Folder · test · medium · {"product":"windows","category":"file_event"}
• Unsigned .node File Loaded · experimental · medium · {"category":"image_load","product":"windows"}
• Potential MsiExec Masquerading · test · high · {"category":"process_creation","product":"windows"}
• Suspicious Scheduled Task Creation via Masqueraded XML File · test · medium · {"product":"windows","category":"process_creation"}
• Scheduled Task Creation Masquerading as System Processes · experimental · high · {"category":"process_creation","product":"windows"}
• Windows Processes Suspicious Parent Directory · test · low · {"category":"process_creation","product":"windows"}
• Suspicious Process Masquerading As SvcHost.EXE · test · high · {"category":"process_creation","product":"windows"}
• Uncommon Svchost Command Line Parameter · experimental · high · {"category":"process_creation","product":"windows"}
• Uncommon Svchost Parent Process · test · medium · {"category":"process_creation","product":"windows"}
• Potential Binary Impersonating Sysinternals Tools · test · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0347 Detection Strategy for Masquerading via Legitimate Resource Name or Location

AN0983 Analytic 0983

Detects processes or binaries executed from trusted directories (e.g., System32) or using trusted names (e.g., svchost.exe) where the metadata, hash, or parent process does not align with legitimate activity patterns.

AN0984 Analytic 0984

Detects renamed binaries or scripts placed into trusted paths like /usr/bin or /lib with mismatched metadata or unexpected creation/modification times.

AN0985 Analytic 0985

Detects binaries or launch daemons in /System/Library or /Applications with mismatched bundle names, unexpected metadata, or improper installation origin.

AN0986 Analytic 0986

Detects malicious containers or pods using names, labels, or namespaces that mimic legitimate workloads; also checks for image layer mismatches and unauthorized resource deployments.

AN0987 Analytic 0987

Detects VIBs, scripts, or binaries placed into directories like /bin or /etc/vmware with names mimicking standard ESXi components. Also monitors unauthorized creation of services.