Masquerading: Match Legitimate Resource Name or Location

ID: T1036.005
Tactics: TA0005 Stealth
Sub-technique of: T1036 Masquerading
Platforms: Containers, ESXi, Linux, macOS, Windows
Data sources: Process Creation, File Creation, File Access, Process Modification, File Metadata, Process Metadata, Image Metadata, Module Load, Service Metadata, Scheduled Job Creation
Source: attack.mitre.org
MITRE last modified: 12 Sep 2026

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.^[1]

Detection

DET0347 Detection Strategy for Masquerading via Legitimate Resource Name or Location
Data components: Process Creation, File Creation, File Access, Process Modification, File Metadata, Process Metadata, Image Metadata, Module Load, Service Metadata, Scheduled Job Creation

Mitigations (3)

M1022 Restrict File and Directory Permissions: Use file system access controls to protect folders such as C:\Windows\System32.
M1038 Execution Prevention: Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.
M1045 Code Signing: Require signed binaries and images.

Groups (66)

Showing 60 of 66. Full list on attack.mitre.org.

Software (145)

Showing 60 of 145. Full list on attack.mitre.org.

References

Aquasec Kubernetes Backdoor 2023