T1036.005 Match Legitimate Resource Name or Location — Attack Simulation

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows Registry key may be given a close approximation to…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Masquerading cmd.exe as VEDetector.exe
windows automated powershell
Procedure 03ae82a6-9fa0-465b-91df-124d8ca5c4e8; elevation required; cleanup present, not reviewed. Not executed or individually validated.
Masquerade as a built-in system executable
windows automated powershell
Procedure 35eb8d16-9820-4423-a2a1-90c4f5edd9ca; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Execute a process from a directory masquerading as the current parent directory
macos linux automated sh
Procedure 812c3ab8-94b0-4698-a9bf-9420af23ce24; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint containers onprem virtualization Containers ESXi Linux macOS Windows stealth isolated_authorized_lab procedure_review_required telemetry_configuration_required some_candidates_require_elevation

can_simulate subtechnique source_mapped

Detection and collection

T1036.005 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.