t1036-005-match-legitimate-resource-name-or-location

name	T1036.005_match-legitimate-resource-name-or-location
description	Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1036.005","defense-evasion","containers","esxi","linux","macos","windows","sub-technique"]
technique_id	T1036.005
tactic	defense-evasion
all_tactics	["defense-evasion"]
platforms	["Containers","ESXi","Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1036/005
tech_stack	["containers","esxi","linux","macos","windows"]
cwe_ids	["CWE-693"]
chains_with	["T1036","T1036.001","T1036.002","T1036.003","T1036.004","T1036.006","T1036.007","T1036.008","T1036.009","T1036.010","T1036.011","T1036.012"]
prerequisites	["T1036"]
severity_boost	{"T1036":"Chain with T1036 for deeper attack path","T1036.001":"Chain with T1036.001 for deeper attack path","T1036.002":"Chain with T1036.002 for deeper attack path"}

T1036.005 Match Legitimate Resource Name or Location

Sub-technique of: T1036

High-Level Description

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Containers, ESXi, Linux, macOS, Windows

What to Check

• Identify if Match Legitimate Resource Name or Location technique is applicable to target environment
• Check Containers systems for indicators of Match Legitimate Resource Name or Location
• Check ESXi systems for indicators of Match Legitimate Resource Name or Location
• Check Linux systems for indicators of Match Legitimate Resource Name or Location
• Verify mitigations are bypassed or absent (3 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Execute a process from a directory masquerading as the current parent directory

Create and execute a process from a directory masquerading as the current parent directory (... instead of normal ..)

Supported Platforms: macos, linux

mkdir $HOME/...
cp $(which sh) $HOME/...
/.../sh -c