T1036 Masquerading — Detection Rules

Source-backed rule directory

• Potentially Suspicious Execution From Tmp Folder · test · medium · {"product":"linux","category":"process_creation"}
• Interactive Bash Suspicious Children · test · medium · {"product":"linux","category":"process_creation"}
• New or Renamed User Account with '$' Character · test · medium · {"product":"windows","service":"security"}
• Password Protected ZIP File Opened (Suspicious Filenames) · test · high · {"product":"windows","service":"security"}
• Windows Binaries Write Suspicious Extensions · test · high · {"category":"file_event","product":"windows"}
• Potential Homoglyph Attack Using Lookalike Characters in Filename · test · medium · {"category":"file_event","product":"windows"}
• Suspicious Calculator Usage · test · high · {"category":"process_creation","product":"windows"}
• Suspicious CodePage Switch Via CHCP · test · medium · {"category":"process_creation","product":"windows"}
• CreateDump Process Dump · test · high · {"category":"process_creation","product":"windows"}
• DumpMinitool Execution · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious DumpMinitool Execution · test · high · {"category":"process_creation","product":"windows"}
• Explorer Process Tree Break · test · medium · {"category":"process_creation","product":"windows"}
• Findstr Launching .lnk File · test · medium · {"category":"process_creation","product":"windows"}
• Forfiles.EXE Child Process Masquerading · test · high · {"category":"process_creation","product":"windows"}
• HackTool - XORDump Execution · test · high · {"category":"process_creation","product":"windows"}
• Potential Fake Instance Of Hxtsr.EXE Executed · test · medium · {"product":"windows","category":"process_creation"}
• CodePage Modification Via MODE.COM To Russian Language · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious MSDT Parent Process · test · high · {"category":"process_creation","product":"windows"}
• PUA - Potential PE Metadata Tamper Using Rcedit · test · medium · {"category":"process_creation","product":"windows"}
• Renamed CreateDump Utility Execution · test · high · {"category":"process_creation","product":"windows"}
• Renamed ZOHO Dctask64 Execution · test · high · {"category":"process_creation","product":"windows"}
• Renamed Plink Execution · test · high · {"category":"process_creation","product":"windows"}
• Process Memory Dump Via Comsvcs.DLL · test · high · {"category":"process_creation","product":"windows"}
• Suspicious Process Start Locations · test · medium · {"category":"process_creation","product":"windows"}
• Sdiagnhost Calling Suspicious Child Process · test · high · {"category":"process_creation","product":"windows"}
• Potential Command Line Path Traversal Evasion Attempt · test · medium · {"category":"process_creation","product":"windows"}
• Process Execution From A Potentially Suspicious Folder · test · high · {"category":"process_creation","product":"windows"}
• Potential Homoglyph Attack Using Lookalike Characters · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Process Parents · test · high · {"category":"process_creation","product":"windows"}
• System File Execution Location Anomaly · test · high · {"category":"process_creation","product":"windows"}
• Procdump Execution · test · medium · {"category":"process_creation","product":"windows"}
• Potential SysInternals ProcDump Evasion · test · high · {"category":"process_creation","product":"windows"}
• Potential LSASS Process Dump Via Procdump · stable · high · {"category":"process_creation","product":"windows"}
• Taskmgr as LOCAL_SYSTEM · test · high · {"category":"process_creation","product":"windows"}
• New Process Created Via Taskmgr.EXE · test · low · {"category":"process_creation","product":"windows"}
• Potential ReflectDebugger Content Execution Via WerFault.EXE · test · medium · {"product":"windows","category":"process_creation"}
• Suspicious Child Process Of Wermgr.EXE · test · high · {"category":"process_creation","product":"windows"}
• Suspicious Windows Update Agent Empty Cmdline · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1036 Masquerading

MATCH(filename_or_service_name IN trusted_names) AND hash_or_path_or_publisher NOT_IN approved_values -> ALERT

• Process Execution Logs
• File-System Activity Logs
• Application-Control Logs
• Atlas source section

Anomaly models

ATT&CK analytic guidance

DET0127 Behavioral Detection of Masquerading Across Platforms via Metadata and Execution Discrepancy

AN0355 Analytic 0355

Adversary renames LOLBINs or deploys binaries with spoofed file names, internal PE metadata, or misleading icons to appear legitimate. File creation is followed by execution or service registration inconsistent with known usage.

AN0356 Analytic 0356

Adversary drops renamed binaries in uncommon directories (e.g., /tmp, /dev/shm) or uses special characters in names (e.g., trailing space, Unicode RLO). Execution or cronjob registration follows shortly after file drop.

AN0357 Analytic 0357

Adversary creates disguised launch daemons or apps with misleading names and bundle metadata (e.g., Info.plist values inconsistent with binary path or icon). Launch is correlated with user logon or persistence setup.

AN0358 Analytic 0358

Adversary uses renamed container images, injects files into containers with misleading names or metadata (e.g., renamed system binaries), and executes them during startup or scheduled jobs.

AN0359 Analytic 0359

Adversary places scripts or binaries with misleading names in /etc/rc.local.d or /var/spool/cron, or registers services with legitimate-sounding names not present in default ESXi builds.