メニュー
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1036-005-match-legitimate-resource-name-or-locationコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
SOC 職業分類に基づく
SKILL.md を表示中
| name | T1036.005_match-legitimate-resource-name-or-location |
| description | Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1036.005","defense-evasion","containers","esxi","linux","macos","windows","sub-technique"] |
| technique_id | T1036.005 |
| tactic | defense-evasion |
| all_tactics | ["defense-evasion"] |
| platforms | ["Containers","ESXi","Linux","macOS","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1036/005 |
| tech_stack | ["containers","esxi","linux","macos","windows"] |
| cwe_ids | ["CWE-693"] |
| chains_with | ["T1036","T1036.001","T1036.002","T1036.003","T1036.004","T1036.006","T1036.007","T1036.008","T1036.009","T1036.010","T1036.011","T1036.012"] |
| prerequisites | ["T1036"] |
| severity_boost | {"T1036":"Chain with T1036 for deeper attack path","T1036.001":"Chain with T1036.001 for deeper attack path","T1036.002":"Chain with T1036.002 for deeper attack path"} |
Sub-technique of: T1036
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.
This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.
Platforms: Containers, ESXi, Linux, macOS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Create and execute a process from a directory masquerading as the current parent directory (... instead of normal ..)
Supported Platforms: macos, linux
mkdir $HOME/...
cp $(which sh) $HOME/...
/.../sh -c
Launch an executable that attempts to masquerade as a legitimate executable.
Supported Platforms: windows
Add-Type -TypeDefinition @'
public class Test {
public static void Main(string[] args) {
System.Console.WriteLine("tweet, tweet");
}
}
'@ -OutputAssembly "#{executable_filepath}"
Start-Process -FilePath "#{executable_filepath}"
This test simulates an adversary renaming cmd.exe to VEDetector.exe to masquerade as a legitimate application. The test copies cmd.exe, renames it to VEDetector.exe, adds a registry run key for persistence, and executes the renamed binary. This technique may be used to evade detection by mimicking legitimate software names or locations.
Expected Output:
References:
Supported Platforms: windows Elevation Required: Yes
# Copy and rename cmd.exe to VEDetector.exe
Copy-Item -Path "#{source_file}" -Destination "#{ved_path}\VEDetector.exe" -Force
# Create registry run key for persistence
New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "VEDetector" -Value "#{ved_path}\VEDetector.exe" -PropertyType String -Force
# Start the renamed process
Start-Process -FilePath "#{ved_path}\VEDetector.exe"
Start-Sleep -Seconds 5
Dependencies:
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Match Legitimate Resource Name or Location by examining the target platforms (Containers, ESXi, Linux).
Assess Existing Defenses: Review whether mitigations for T1036.005 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Use file system access controls to protect folders such as C:\Windows\System32.
Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.
Require signed binaries and images.
| Finding | Severity | Impact |
|---|---|---|
| Match Legitimate Resource Name or Location technique applicable | High | Defense Evasion |
| CWE ID | Title |
|---|---|
| CWE-693 | Protection Mechanism Failure |